CVE-2021-21423 Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2020-13350

CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are =13.5.0, =13.4.0, 13.4.5,13.3.9...

PT-2020-19391

Name of the Vulnerable Software and Affected Versions Aruba Airwave Software versions prior to 1.3.2 Description A remote execution of arbitrary commands issue was discovered. This allows for the execution of arbitrary commands, potentially leading to unauthorized access and control...

Design/Logic Flaw

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves...

CVE-2019-3421: Improper Neutralization of Special Elements used in a Command

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system...

Rittal Chiller SK 3232-Series Improper Access Control Vulnerability

The Rittal Chiller SK 3232-Series is a liquid cooling device from Rittal, Germany. An improper access control vulnerability in the web interface in the Rittal Chiller SK 3232-Series, which arises from an authentication mechanism that is not sufficiently protected to prevent unauthorized...

YjV2XfO8XULm45N

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

CVE-2019-13953

CVE-2019-13953 affects the BLE authentication module in the YI M1 Mirrorless Camera V3.2-cn. The vulnerability allows an attacker to bypass authentication by sending a sequence of BLE commands, enabling sensitive data leakage (e.g., personal photos) and the ability to control the camera to record...

CVE-2019-11061

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://target/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 Confidentiality, Integrity...

CVE-2019-15745: Use of Hard-coded Credentials

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart...

Prima Systems FlexAir

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Prima Systems Equipment: FlexAir Vulnerabilities : OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site...

Directory traversal

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existi...

CVE-2019-3409: Improper Neutralization of Special Elements used in an OS Command

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification, unauthorized users can take advantage of this vulnerability to control the user terminal system...

CVE-2019-3935

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi. A remote, unauthenticated attacker can use this vulnerability to start, stop, and disconnect active slideshows...

Design/Logic Flaw

Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way...

PT-2019-19898

Name of the Vulnerable Software and Affected Versions ABUS Secvest wireless alarm system FUAA50000 version 3.01.01 ABUS Secvest remote controls FUBE50014 affected versions not specified ABUS Secvest remote controls FUBE50015 affected versions not specified Description The issue arises from the us...

CVE-2019-9863: Use of Insufficiently Random Values

Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way...

Joomla Akeeba Backup 6.3.3 Database Disclosure

Exploit Title : Joomla Akeeba Backup Components 6.3.3 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 19/01/2019 Vendor Homepage : akeebabackup.com Software Information Link : extensions.joomla.org/extension/akeeba-backup/ Software Download...

Joomla ZHYandexMap 8.0.0.2 Database Disclosure

Exploit Title : Joomla ZHYandexMap Components 8.0.0.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/01/2019 Vendor Homepage : joomla.org Software Information Link : extensions.joomla.org/extension/zh-yandexmap/ Software Download Link :...

WordPress Disqus Comment System 2.87 Database Disclosure

Exploit Title : WordPress Disqus Comment System Plugins 2.87 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : disqus.com wordpress.org/plugins/disqus-comment-system/ Software Download Link :...