Mozilla Firefox Denial of Service Vulnerability (CNVD-2021-89693)

Mozilla Firefox, commonly known as "Firefox" in Chinese, is a free and open source web browser developed by Mozilla that uses the Gecko typography engine and supports multiple operating systems. It can cause a denial of service when Firefox browser parameters are arbitrarily changed. An attacker...

Huawei Emui and Magic UI Configuration Flaw Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. Huawei Emui and Magic UI have security vulnerabilities that can be exploited by attackers to compromise service confidentiality...

CVE-2021-30808

This issue was addressed with improved checks. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. A malicious application may be able to modify protected parts of the file system...

Leverage Virtual Patching to Prevent Network Threats

Implementing an intrusion prevention system is only one step in your cybersecurity efforts. Learn how virtual patching helps keep your IPS up to date and protect against zero-day threats, keeping your systems safe from attack...

Security Risks of Client-Side Scanning

Even before Apple made its announcement, law enforcement shifted their battle for backdoors to client-side scanning. The idea is that they wouldnt touch the cryptography, but instead eavesdrop on communications and systems before encryption or after decryption. Its not a cryptographic backdoor, b...

CVE-2021-38178

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious...

Mozilla Firefox Post-release Reuse Vulnerability (CNVD-2021-90095)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to a post-release reuse vulnerability that exists due to a post-release usage error in the nsLanguageAtomService object. A remote attacker could use this vulnerability to trick a...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2021-78437)

IBM Sterling File Gateway is an application for transferring files between internal and external partners, allowing you to more securely and reliably transfer files with trading partners.An information disclosure vulnerability exists in IBM Sterling File Gateway version 6.0.1.0-6.1.0.2. An attack...

Authorization

TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in...

Zoho ManageEngine Remote Access Plus Trust Management Issue Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A trust management issue vulnerability previously existed in Zoho ManageEngine Remote Access Plus 10.1.2121.1, which stems from the fact that the affected product has hard-coded credentials associated with resetPWD.x...

Google Android Elevation of Privilege Vulnerability (CNVD-2021-77618)

Android is a Linux-based open source operating system developed by Google Inc. and the Open Handheld Alliance OHA. an elevation of privilege vulnerability exists in the Framework component of Google Android. An attacker could exploit this vulnerability to gain elevated privileges on the system...

Erc20.transfer() return value is ignored

Handle pants Vulnerability details According to the ERC-20 Token Standard, the function transfer returns false on failure. However, the return value of Erc20.transfer is ignored 8 times: 1. In Swivel.exitVaultFillingZcTokenExit, line 313. 2. In Swivel.exitVaultFillingZcTokenExit, line 315. 3. In...

Default credentials

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system...

CVE-2021-23857

CVE-2021-23857 affects Bosch Rexroth IndraMotion Mlc (networked system). The vulnerability allows login with a password hash instead of a password, per Red Hat advisory description, which can enable an attacker to authenticate without the correct password. This issue is linked to CVE-2021-23858, ...

3.1M Neiman Marcus Customer Card Details Breached

Dallas-based Neiman Marcus Group is known worldwide as the go-to luxury retailer for the well-heeled. But their reputation for impeccable quality just took a big hit with revelations that the company was breached by an attacker back in May 2020. It took 17 months for the retailer to notice. Just...

Information disclosure

IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197667...

SUSE-SU-2021:3207-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks bsc1190115. - CVE-2021-38160: Data corruption or...

CVE-2021-37912

The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in...

Input validation

Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject ABAP code to gain access to Backend Database. On successful exploitation the threat actor could...

CVE-2021-37184

A vulnerability has been identified in Industrial Edge Management All versions V1.3. An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system...