Unpatched Security Flaws Expose Mitsubishi Safety PLCs to Remote Attacks

Multiple unpatched security vulnerabilities have been disclosed in Mitsubishi safety programmable logic controllers PLCs that could be exploited by an adversary to acquire legitimate user names registered in the module via a brute-force attack, unauthorizedly login to the CPU module, and even cau...

The vulnerability of the PBX software for IP communications allows attackers to carry out cross-site scripting attacks.

The vulnerability of PBX software for IP communications is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

WifiDemon – iPhone Wifi bug exposed devices to remote attacks

By Sudais Asif Dubbed WifiDemon by researchers; the attack required the victim’s wifi to be set on auto-join which is by default in iPhones. This is a post from HackRead.com Read the original post: WifiDemon - iPhone Wifi bug exposed devices to remote attacks...

Google Chrome WebSerial use-after-release vulnerability

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome WebSerial, which allows remote attackers to potentially attack via specially crafted HTML pages using heap corruption...

Hardcoded credentials

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...

Advisory ROSA-SA-2021-1949

Software: perl 5.16.3 OS: Cobalt 7.9 CVE-ID: CVE-2014-4330 CVE-Crit: MEDIUM CVE-DESC: The Dumper method in Data :: Dumper before 2.154, which was used in Perl 5.20.1 and earlier, allows context-sensitive attackers to cause a denial of service stack consumption and failure via an array reference...

Unpatched flaws exposing Linux marketplaces to remote attacks

By Waqas The vulnerabilities remain unpatched and can be exploited to launch supply-chain attacks or achieve RCE against Linux marketplaces. This is a post from HackRead.com Read the original post: Unpatched flaws exposing Linux marketplaces to remote attacks...

Prominent defibrillator management tool exposed to remote attacks

By Deeba Ahmed High-Risk security flaws found and patched in ZOLL defibrillator management software. Here's what happened and what was vulnerable. This is a post from HackRead.com Read the original post: Prominent defibrillator management tool exposed to remote attacks...

CVE-2021-34803

TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations...

Trend Micro InterScan Web Security Virtual Appliance Cross-Site Scripting Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A cross-site scripting vulnerability exists in Trend Micro InterScan Web Security Virtual...

PT-2021-17936 · Qnap Systems · Qnap Helpdesk +1

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Helpdesk versions prior to 3.0.4 Description: An improper access control issue has been reported, affecting QNAP NAS. This issue allows remote attackers to compromise the security of the software. Recommendations: For versio...

CHIYU IoT Devices - (Telnet) Authentication Bypass Exploit

Exploit Title: CHIYU IoT Devices - 'Telnet' Authentication Bypass Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, BF-450M, and SEMAC - all firmware versions June 20...

CHIYU IoT Denial Of Service

Exploit Title: CHIYU IoT Devices - Denial of Service DoS Date: 01/06/2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC - all...

Vulnerabilities fixed in Cisco Webex Meetings and Webex Server

Cisco has fixed vulnerabilities in Webex Meetings, Webex Meetings Server, Webex Teams and Webex client software. The vulnerabilities allow a malicious person, possibly remotely, to able to launch attacks that result in the following categories of damage: Circumvention of security measure. Remote...

CHIYU IoT Telnet Authentication Bypass

Exploit Title: CHIYU IoT Devices - 'Telnet' Authentication Bypass Date: 01/06/2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, BF-450M, and SEMAC - all firmware...

CHIYU IoT Devices - 'Telnet' Authentication Bypass

Exploit Title: CHIYU IoT Devices - 'Telnet' Authentication Bypass Date: 01/06/2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, BF-450M, and SEMAC - all firmware...

USN-4973-1 python3.8 vulnerability

It was discovered that the Python stdlib ipaddress API incorrectly handled octal strings. A remote attacker could possibly use this issue to perform a wide variety of attacks, including bypassing certain access restrictions...

CHIYU TCP/IP Converter CRLF Injection

Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection Date: May 31 2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, and BF-450M TCP/IP Converter device...

CHIYU IoT Cross Site Scripting

Exploit Title: CHIYU IoT devices - 'Multiple' Cross-Site Scripting XSS Date: May 31 2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, BF-450M, BF-630, BF631-W,...

CHIYU TCP/IP Converter devices - CRLF injection

Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection Date: May 31 2021 Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, and BF-450M TCP/IP Converter device...