Weak password vulnerability in the virtualization authorization management system of Deepcore Technology Co.

DeepService Technology Co., Ltd. is a product and service provider specializing in enterprise-class network security, cloud computing, IT infrastructure and the Internet of Things IoT. A weak password vulnerability exists in the virtualization authorization management system of DeepSign Technolog...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

CVE-2022-30425

Affected product : Tenda HG6 router (firmware/software version 3.3.0-210926, HG6). Vulnerability : OS command injection via HTTP POST parameters in the formPing/formPing6 and formTracert/formTracert6, exploiting unfiltered input in the pingAddr and traceAddr fields. Root cause : failure to proper...

JVN#13878856: Mobaoku-Auction & Flea Market App for iOS vulnerable to improper server certificate verification

Mobaoku-Auction & Flea Market App for iOS provided by DeNA Co., Ltd. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update the application to the...

Logic Flaw Vulnerability in Netnifty's Web Tampering Prevention System

Beijing Netnifty Information Technology Company is a leading enterprise in the domestic information security industry, specializing in the research and development, production and sales of information security products, and providing hierarchical overall security solutions and security profession...

JVN#46241173: EC-CUBE plugin "Easy Blog for EC-CUBE4" vulnerable to cross-site request forgery

EC-CUBE plugin "Easy Blog for EC-CUBE4" provided by COREMOBILE Co. Ltd. contains a cross-site request forgery vulnerability CWE-352. Impact If a site administrator who is logging in to the management screen of EC-CUBE on which the plug-in is installed accesses a specially crafted page, a blog...

Logic Flaw Vulnerability in Pantum M6700DW Series from Zhuhai Pentium Printing Technology Co.

Zhuhai Bento Printing Technology Co., Ltd. is a printer to master the core technology and independent intellectual property rights, research and development, design, production, sales of printers, consumables and printing output solutions as one of the enterprises. Zhuhai Pantum Printing Technolo...

Command Execution Vulnerability in JingYun Terminal Security Management System of Beijing Centron Link Information Technology Co.

Ltd. was established in July 2016, by Beijing Qixingchen Information Security Technology Co., Ltd., Beijing Beixinyuan Software Co., Ltd., Beijing Zhengyong Information Technology Co. Beijing Centron Lead Information Technology Co., Ltd. Jing cloud terminal security management system there is a...

Logic flaw vulnerability in the security management system of Centron View cloud terminal

CentronView Terminal Security Management System is an enterprise-level network anti-virus system developed by Beijing CentronView Information Technology Co. There is a logic flaw vulnerability in the Centron View Cloud Terminal Security Management System, which can be exploited by attackers to...

Arbitrary File Download Vulnerability in Centron View Cloud Terminal Security Management System

CentronView Terminal Security Management System is an enterprise-level network anti-virus system developed by Beijing CentronView Information Technology Co. There is an arbitrary file download vulnerability in CentronView Cloud Terminal Security Management System, which can be exploited by...

CVE-2021-26382

An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor ACP, irrespective of the respective signing key being declared as usable for authenticating an ACP firmware image, potentially resulting in a denial of service...

kernel: DoS in ccp_run_aes_gcm_cmd() function

A memory leak flaw was found in the Linux kernel's ccprunaesgcmcmd function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability...

Command injection

Command injection vulnerability in Manual Ping Form Web UI in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 allows a remote attacker to inject arbitrary code via the field...

CVE-2022-23332

CVE-2022-23332 is a command-injection vulnerability in the Manual Ping Form (Web UI) of Shenzhen Ejoin Information Technology Co., Ltd. for ACOM508/ACOM516/ACOM532 devices (version 609-915-041-100-020). The flaw allows a remote attacker to inject arbitrary code via a field in the Web UI’s Manual ...

Privilege escalation

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server...

Unrestricted file upload

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server...

CVE-2022-28120

The CVE-2022-28120 entry concerns Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0. A vulnerability in the file upload feature allows an attacker to gain control of the server. The root cause is described in connected sources...

CVE-2022-28606

The CVE-2022-28606 entry describes an arbitrary file upload vulnerability in BossCMS 1.0 from Wenzhou Huoyin Information Technology Co. The flaw allows an attacker to upload files to the server and potentially gain control of the server. No concrete remediation details are provided in the connect...

CVE-2022-28606

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server...

Tenda HG6 3.3.0 Remote Command Injection Vulnerability

Tenda HG6 version 3.3.0 suffers from a remote command injection vulnerability. It can be exploited to inject and execute arbitrary shell commands through the pingAddr and traceAddr HTTP POST parameters in formPing, formPing6, formTracert and formTracert6 interfaces. Tenda HG6 v3.3.0 Remote Comman...