CVE-2021-44162 Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal

Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication...

74 CMS Cross-Site Scripting Vulnerability (CNVD-2021-99667)

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Co. 74CMS has a cross-site scripting vulnerability in version v6.0.4, which originates from /index.php?m=&c=help&a=helplist&key missing a data validation filter for user-supplied data and output. An attacker coul...

WECON LeviStudioU

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow arbitrary code execution. 3. TECHNICAL DETAILS...

“Crypto” Means “Cryptography,” Not “Cryptocurrency”

I have long been annoyed that the word "crypto" has been co-opted by the blockchain people, and no longer refers to "cryptography." Im not the only one...

SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd.

SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the Flash Flood...

Command Execution Vulnerability in the Firewall of Beijing NetGuard Nebula Information Technology Co.

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

CVE-2021-42838

Summary: CVE-2021-42838 affects Grand Vice info Co. webopac7, where the book search field does not properly restrict special characters. Vulnerability details: Unauthenticated remote attackers can inject JavaScript syntax via the search input, enabling reflected XSS attacks. The root cause is ina...

CVE-2021-42838 Grand Vice info Co. webopac7 - Reflected XSS

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

CVE-2021-42839: Unrestricted Upload of File with Dangerous Type

Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services...

Unauthorized Access Vulnerability in ioLogik E1242 Series of Mosaic Technology (Shanghai) Co.

The ioLogik E1242 series are daisy-chained Ethernet switches that support the most commonly used I/O data acquisition protocols to match a wide range of applications. Mosa Technologies Shanghai Co., Ltd. ioLogik E1242 series suffers from an unauthorized access vulnerability, which can be exploite...

CVE-2021-42838: Improper Neutralization of Input During Web Page Generation

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

PT-2021-23692

Name of the Vulnerable Software and Affected Versions Grand Vice info Co. webopac7 affected versions not specified Description The issue concerns the book search field parameter in webopac7, which does not properly restrict the input of special characters. This allows unauthenticated attackers to...

bigcitymovingco.com Improper Access Control vulnerability OBB-2267427

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

vulcan-777.co Improper Access Control vulnerability OBB-2254831

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Buffer overflow

Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...

CVE-2020-28963

Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...

CVE-2020-28963: Buffer Copy without Checking Size of Input

Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...

PT-2021-11612

Name of the Vulnerable Software and Affected Versions: Passcovery Co. Ltd ZIP Password Recovery version 3.70.69.0 Description: A buffer overflow issue was discovered in the decompress function. Recommendations: For version 3.70.69.0, at the moment, there is no information about a newer version th...

paradiselimousineco.com Improper Access Control vulnerability OBB-2174358

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-42335 Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS

Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack...