Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency “CISA” that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020,...

ThroughTek Kalay P2P SDK

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: Kalay P2P SDK Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could permit remote code execution and unauthorized access to...

ThroughTek P2P SDK

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: P2P SDK Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION ThroughTek supplies multiple original equipment manufacturers of IP cameras with P2P...

Information Disclosure

ansible is vulnerable to information disclosure. The nolog feature is not enabled by default and confidential information such as the authkey and privkey are logged to the console...

MISP cross-site scripting vulnerability (CNVD-2021-08162)

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

Design/Logic Flaw

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572: Improper Neutralization of Input During Web Page Generation

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

CVE-2020-29572 affects MISP 2.4.135, with a cross-site scripting vulnerability in the file app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp via the authkey comment field. The root cause is unsanitized input leading to XSS in the template rendering, enabling arbitrary script e...

MISP 跨站脚本漏洞

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...

Discuz X3. 3 patch security analysis-vulnerability warning-the black bar safety net

Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3. 3SCUTF8 with DiscuzX3. 4SCUT...

Discuz X3. 3 authkey generation algorithm of the security vulnerability and the background arbitrary code execution vulnerability

0x00 background description Discuz official in 2017 8 May 1 release of the latest version of the X3. 4 version, the latest version fixes multiple security issues. 360CERT and 360 0KEE Team then for the events to follow. 0x01 vulnerability overview 360CERT and 360 0KEE Team by comparing DiscuzX3...

phpcms v9 后台任意文件读取(可获取authkey)

No description provided by source...

PHPCMS V9 phpsso/index.php authkey 泄露漏洞

No description provided by source...

Phpcmsv9 injection 0day analysis-vulnerability warning-the black bar safety net

According to the video I learned that is injected from the phpcms/modules/message/classes/messagetag. class. php checknew function public function checknew $where = array'sendtoid'=$this-username,'folder'='inbox','status'='1'; $newcount = $this-messagedb-count$where; //Check whether there is does...

PHPCMS V9 /api.php Authkey 信息泄漏

No description provided by source...

用友政务官方网站存在漏洞导致authkey泄露

简要描述： 用友政务官方网站存在漏洞导致authkey泄露 详细说明： 同学在用友政务工作，闲着没事看了看他们的官方网站，顺便手贱摸了一下·· http://www.yonyougov.com/index.php?m=admin&c=index&a=login&pchash= PHPCMS V9的系统 authkey很重要，可注射拿shell...

PHPCMS latest version authkey leakage vulnerability

PHPCMS is a content management system. PHPCMS latest version authkey leak vulnerability, attackers use authkey and cms comes with the encryption and decryption function can be encrypted, you can change the password, but also can be injected...