1989 matches found
74 CMS Cross-Site Scripting Vulnerability (CNVD-2021-99667)
74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Co. 74CMS has a cross-site scripting vulnerability in version v6.0.4, which originates from /index.php?m=&c=help&a=helplist&key missing a data validation filter for user-supplied data and output. An attacker coul...
WECON LeviStudioU
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow arbitrary code execution. 3. TECHNICAL DETAILS...
“Crypto” Means “Cryptography,” Not “Cryptocurrency”
I have long been annoyed that the word "crypto" has been co-opted by the blockchain people, and no longer refers to "cryptography." Im not the only one...
SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd.
SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the Flash Flood...
Command Execution Vulnerability in the Firewall of Beijing NetGuard Nebula Information Technology Co.
Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...
CVE-2021-42838
Summary: CVE-2021-42838 affects Grand Vice info Co. webopac7, where the book search field does not properly restrict special characters. Vulnerability details: Unauthenticated remote attackers can inject JavaScript syntax via the search input, enabling reflected XSS attacks. The root cause is ina...
CVE-2021-42838 Grand Vice info Co. webopac7 - Reflected XSS
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...
Unauthorized Access Vulnerability in ioLogik E1242 Series of Mosaic Technology (Shanghai) Co.
The ioLogik E1242 series are daisy-chained Ethernet switches that support the most commonly used I/O data acquisition protocols to match a wide range of applications. Mosa Technologies Shanghai Co., Ltd. ioLogik E1242 series suffers from an unauthorized access vulnerability, which can be exploite...
bigcitymovingco.com Improper Access Control vulnerability OBB-2267427
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
vulcan-777.co Improper Access Control vulnerability OBB-2254831
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Buffer overflow
Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...
CVE-2020-28963
Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function...
paradiselimousineco.com Improper Access Control vulnerability OBB-2174358
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-42335 Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack...
CVE-2021-42329 ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS
The “ListAdd” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks...
SQL injection vulnerability exists in the flash flood monitoring and warning platform of Four Creation Technology Co.
Si Chuang Technology Co., Ltd. is a disaster mitigation and Xingli information service provider in China. There is a SQL injection vulnerability in the flash flood monitoring and early warning platform of Sichong Technology Co., Ltd. which can be exploited by attackers to obtain sensitive...
S-CMS XML External Entity Injection Vulnerability
S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 3.0 version of the /api/notify.php exists XML external entity injection vulnerability. An attacker can use this vulnerability to read arbitrary files...
deadspartan.co.uk Cross Site Scripting vulnerability OBB-2161374
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Binary Vulnerability in KingView
KingView is an industrial automation configuration software produced by Beijing Asian Control Technology Development Co. A binary vulnerability exists in KingView, which can be exploited by attackers to cause the program to crash...
SQL Injection Vulnerability in Water Resources Engineering Management System of Siltronic Ltd.
SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the water project...