16 matches found
EUVD-2020-6278
Malware in sbrugna...
EUVD-2020-6268
Malware in sbrugna...
EUVD-2021-23842
Malware in sbrugna...
CVE-2020-14119
There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom 1.1.12...
CVE-2020-14109
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version = 1.1.12...
The design defect of the ActivePool rehypothecation mechanism, ReaperVaultV2 administrators have too much authority and have the conditions and motives to do evil, so make users lack trust in the ETHOS system (crisis of trust)
Lines of code Vulnerability details Impact In the design logic of the current system, ActivePool holds all the collaterals of active troves and deposits part of them in ReaperVaultV2 for re-mortgaging. If the deposit and withdraw functions of ReaperVaultV2 revert, Core functions such as borrowing...
Design/Logic Flaw
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority...
CVE-2021-37270: Missing Authorization
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority...
PT-2021-21597
Name of the Vulnerable Software and Affected Versions CMS Enterprise Website Construction System version 5.0 Description The issue allows attackers to gain unauthorized access to the background administrator authority without logging in. This is achieved by directly accessing a specified backgrou...
CVE-2020-14109
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version = 1.1.12...
CVE-2020-14109: Improper Neutralization of Special Elements used in a Command
There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version = 1.1.12...
CVE-2020-14119: Improper Neutralization of Special Elements used in a Command
There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom 1.1.12...
PT-2021-9697
Name of the Vulnerable Software and Affected Versions Xiaomi router AX3600 versions prior to 1.1.12 Description The issue concerns command injection in the addMeshNode interface of xqnetwork.lua, leading to command execution under administrator authority. Recommendations For versions prior to...
PT-2021-9696
Name of the Vulnerable Software and Affected Versions Xiaomi router AX3600 versions = 1.1.12 Description The issue is related to command injection in the meshd program within the routing system. This results in the execution of commands under administrator authority. Recommendations For versions ...
Concrete CMS: SVG file that HTML Included is able to upload via File Manager
Concrete5 has the whitelist for restricting that malicious file is uploaded. concrete/config/concrete.php, Line no. 8688 The extension whitelist allows to upload SVG file. However, SVG can has the HTML elements in its code. Ref. https://www.w3.org/TR/SVG2/intro.htmlW3CCompatibility If web browser...
Security Bulletin: IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware GUI User May Gain Administrator Authority
Summary A vulnerability exists in the IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware GUI IBM Spectrum Protect™ for Virtual Environments where an authenticated user can execute GUI functions that require the Tivoli Storage Manager administrative credentials without...