CVE-2021-37124

There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit this vulnerability. Successful exploitation could allow the attacker to transport a file to certain...

Smart Car Makers VW & Nissan to Build Smart Factories

The car-making giants have taken big leaps to ensure they address the needs and trends brought by the rapid growth of technologies in the automotive industry...

Unchecked ERC20 transfer calls

Handle loop Vulnerability details ERC20 transfer and transferFrom calls normally return true on a succesful transfer. In DutchAuctionLiquidator the call asset.transfermsg.sender, collateral; is made. asset refers to whichever ERC20 asset is used for the vault of that auction. If asset is an ERC20...

Build Smart ERP 21.0817 - (eidValue) SQL Injection Vulnerability

Exploit Title: Build Smart ERP 21.0817 - 'eidValue' SQL Injection Unauthenticated Exploit Author: Nehru Sethuraman Vendor Homepage: https://ribccs.com/solutions/solution-buildsmart Version: 21.0817 Build: 3 Google Dorks: intitle:buildsmart accounting Tested on: OS - Windows 2012 R2 or 8.1 &...

Build Smart ERP 21.0817 SQL Injection

Exploit Title: Build Smart ERP 21.0817 - 'eidValue' SQL Injection Unauthenticated Date: 24/10/2021 Exploit Author: Nehru Sethuraman Vendor Homepage: https://ribccs.com/solutions/solution-buildsmart Version: 21.0817 Build: 3 Google Dorks: intitle:buildsmart accounting Tested on: OS - Windows 2012 ...

Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)

Exploit Title: Build Smart ERP 21.0817 - 'eidValue' SQL Injection Unauthenticated Date: 24/10/2021 Exploit Author: Nehru Sethuraman Vendor Homepage: https://ribccs.com/solutions/solution-buildsmart Version: 21.0817 Build: 3 Google Dorks: intitle:buildsmart accounting Tested on: OS - Windows 2012 ...

smart-business.co.il Improper Access Control vulnerability OBB-2202151

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

use of transfer() instead of call() to send eth

Handle JMukesh Vulnerability details Impact Use of transfer might render ETH impossible to withdraw becuase after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those contracts will break because their fallback...

Swap.sol implements potentially dangerous transfer

Handle elprofesor Vulnerability details Impact The use of .transfer in Swap.sol may have unintended outcomes on the eth being sent to the receiver. Eth may be irretrievable or undelivered if the msg.sender or feeRecipient is a smart contract. Funds can potentially be lost if; 1. The smart contrac...

.transfer is used for transferring ether

Handle pauliax Vulnerability details Impact payablemsg.sender.transfertoTransfer; feeRecipient.transferaddressthis.balance; It is no longer recommended to use .transfer when sending ether as recipients with custom fallback functions smart contracts will not be able to handle that. You can read mo...

transfer() is not recommended for sending ETH

Handle WatchPug Vulnerability details Since the introduction of transfer, it has typically been recommended by the security community because it helps guard against reentrancy attacks. This guidance made sense under the assumption that gas costs wouldn’t change. It's now recommended that transfer...

File Upload Vulnerability in the Integrated Smart Meter Management System of Xintian Technology Co.

Ltd. is a professional manufacturer and supplier of water meters, energy meters, and gas meters. Ltd. has a file upload vulnerability in its integrated smart meter management system, which can be exploited by attackers to obtain server control privileges...

Command Execution Vulnerability in Neusoft Firewall

Neusoft Group Corporation is a software technology-based company with business focus on smart city, healthcare, smart car connectivity, and software products and services. A command execution vulnerability exists in Neusoft Firewall, which can be exploited by attackers to execute arbitrary comman...

WordPress Smart Grid-Layout Design for Contact Form 7 plugin <= 4.11.8 - Authenticated Arbitrary File Deletion vulnerability

Authenticated Arbitrary File Deletion vulnerability discovered in WordPress Smart Grid-Layout Design for Contact Form 7 plugin versions = 4.11.8. Solution Update the WordPress Smart Grid-Layout Design for Contact Form 7 plugin to the latest available version at least 4.11.9...

CVE-2021-31349 Session Smart Router: Authentication Bypass Vulnerability

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...

128 Technology Session Smart Router vulnerable to authentication bypass

Overview 128 Technology Session Smart Router provided by 128 Technology contains an authentication bypass vulnerability CWE-287. Genta Kataoka of IERAE SECURITY INC. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

QuickAccManager Smart Contract signature verification can be exploited

Handle cmichel Vulnerability details Several different signature modes can be used and Identity.execute forwards the signature parameter to the SignatureValidator library. The returned signer is then used for the privileges check: address signer = SignatureValidator.recoverAddrImplhash, signature...

Mitsubishi Electric SmartRTU 安全漏洞

Mitsubishi Electric smartRTU is an intelligent remote terminal unit RTU from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric SmartRTU that originates from the disclosure of sensitive information in the /web URI of the device. The vulnerability can be exploite...

CVE-2021-31349

The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...

Secure Manufacturing on Cloud, Edge and 5G (Download PDF)

This e-book provides you with insight into system changes brought on by factory production processes and explains how the cloud and 5G have transformed smart factories. You’ll also receive a look into how we map the attack scenario so you can identify the type of risks that lie throughout the...