CVE-2021-34543

The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status. Fixed with...

elecom lan routers access control error vulnerability

elecom lan routers is a router from Elecom Japan. An access control error vulnerability exists in elecom lan routers, which can be exploited by an attacker to bypass access restrictions and gain access to the product's administration screens via an unspecified vector...

Adobe ColdFusion Server Administration Console Detected

Adobe ColdFusion server administration console has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...

Security Bulletin: A Security Vulnerability in IBM Java Runtime affects IBM License Key Server Administration and Reporting Tool and its Agent

Summary A security vulnerability has been found in the IBM® Runtime Environment Java™ used by IBM License Key Server Administration and Reporting Tool and its Agent. A fix has been published to mitigate the same. Vulnerability Details CVEID: CVE-2021-2369 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: A Security Vulnerability in IBM® WebSphere Application Server Liberty affect IBM LKS Administration and Reporting Tool and its Agent

Summary A security vulnerability, related to Apache Commons Compress library, has been found in the IBM® WebSphere Application Server Liberty used by IBM LKS Administration and Reporting Tool and its Agent. A fix has been identified and is being published here. Vulnerability Details CVEID:...

The vulnerability of the ioAdmin tool, related to the storage of confidential information in unencrypted form, allows a perpetrator to gain access to user accounts.

The vulnerability of the ioAdmin tool is related to the storage of confidential information in an unencrypted form. Exploiting this vulnerability can allow a perpetrator to gain access to user accounts...

How to investigate service provider trust chains in the cloud

In a recent Microsoft blog post, we documented technical guidance for organizations to protect themselves from the latest NOBELIUM activity that was found to target technology service providers, which are privileged in their downstream customer tenants, as a method to gain access to their...

How to investigate service provider trust chains in the cloud

In a recent Microsoft blog post, we documented technical guidance for organizations to protect themselves from the latest NOBELIUM activity that was found to target technology service providers, which are privileged in their downstream customer tenants, as a method to gain access to their...

Binatone Motorola-branded Camera Access Control Error Vulnerability

The Binatone Motorola-branded Camera is a Binatone licensed Motorola-branded camera from Binatone, Inc. The vulnerability can be exploited by an attacker on the same network to access the administration page, which can lead to information disclosure or update the device firmware with validated...

Privilege Escalation

samba is vulnerable to escalation of privilege. The vulnerability exists due to the lack of sanitization of user's authorization when RODC read-only domain controller is used when printing administration ticket...

Binatone Motorola-branded Camera 安全漏洞

The Binatone Motorola-branded Camera is a Binatone licensed Motorola-branded camera from Binatone, Inc. The vulnerability can be exploited by an attacker on the same network to access the administration page, which can lead to information disclosure or update the device firmware with validated...

EC-CUBE improper access control vulnerability

EC-CUBE is an open source system for creating shopping websites. EC-CUBE version 2.11.2 - 2.17.1 contains an improper access control vulnerability in the administration interface. An attacker could use this vulnerability to change system settings without proper privileges...

Cross-site Scripting (XSS) - Stored in eventum/eventum

Description Multiple Stored XSS in Administration at eventum 3.10.8 Proof of Concept // PoC.payload " Step to Reproduct Goto Administration Areas and choose to feature below Manage News Input payload into fieldTitle Manage Status Input payload into fieldTitle Manage Projects Input payload into...

Phoenix Contact Fl Mguard 1102 跨站脚本漏洞

The Phoenix Contact Fl Mguard 1102 is a security router from Phoenix Contact, Germany. It is used to protect industrial networks from attacks such as Ip spoofing, Denial of Service Dos and Syn flooding. A cross-site scripting vulnerability exists in the Phoenix Contact FL MGUARD 1102 and 1105,...

Security Bulletin: A vulnerability in Apache Commons Compress Library affects IBM LKS ART and Agent

Summary A ZIP processing vulnerability has been found in Apache Commons Compress. It affects IBM License Key Server Administration & Reporting Tool and its Agent. A mitigation has been released. Vulnerability Details CVEID: CVE-2021-36090 DESCRIPTION: Apache Commons Compress is vulnerable to a...

Keeping Up with Biden Administration Cybersecurity Mandates

With Wednesday’s sweeping cybersecurity mandates issued by the Biden administration, patching Common Vulnerabilities and Exposures CVEs are top of mind — for both federal and private-sector companies alike — to help prevent damaging intrusions. Intensifying the pressure surrounding the latest rou...

Engineers Online Portal 跨站脚本漏洞

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students and teachers. Sourcecodester Online Event Booking and...

XenForo 跨站脚本漏洞

XenForo is an open source commercial Internet forum software package written in the PHP programming language. A cross-site scripting vulnerability exists in XenForo versions prior to 2.2.7, which stems from a lack of filtering and escaping of user input when creating a new advertisement in the...

sudo bug fix and enhancement update

An update is available for sudo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sudo packages contain the sudo utility which allows system administrators to...

GHSA-4P3X-8QW9-24W9 Authenticated Stored XSS in shopware/shopware

Impact Authenticated Stored XSS in Administration Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html Workarounds If you cannot use the security plugin, add the following config to your .htaccess file Header set Content-Security-Policy...