SQL Injection Vulnerability in Dongsheng Logistics Software of Qingdao Dongsheng Weiye Software Co. Ltd (CNVD-2021-08484)

Qingdao Dongsheng Weiye Software Co., Ltd. was founded in November 2004, the company's main business expanded into three major segments, namely, logistics consulting, logistics information platform and logistics software. A SQL injection vulnerability exists in Qingdao Dongsheng Weiye Software Co...

Extreme Office 2019 suffers from a denial of service vulnerability (CNVD-2021-05114)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. Extreme Office 2019 suffers from a denial of service vulnerability. An attacker can exploit the vulnerability to cause the program to crash...

Information Disclosure Vulnerability in Shentong's Large General Database

Tianjin Shenzhou General Data Technology Co., Ltd referred to as "Shenzhou General", belongs to China Aerospace Science and Technology Corporation CASC. It is a professional company engaged in the research and development of databases, big data solutions and data mining analysis products in China...

SQL Injection Vulnerability in CRM E4/Standard Edition of Pengwei Software Co.

The general business items of Pengwei Software Co., Ltd. are: technical development and sales of computer hardware and software, electronic products, etc. A SQL injection vulnerability exists in the CRM E4/Standard Edition of Pengwei Software Co., Ltd. that can be exploited by attackers to obtain...

Extreme Office suffers from a memory corruption vulnerability (CNVD-2021-03422)

Extreme Office is an independently controlled office learning software developed by Beijing Haiteng Times Technology Co. A memory corruption vulnerability exists in Extreme Office. An attacker can exploit this vulnerability to cause the program to crash...

Stripe: GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson

@bubbounty discovered an Insecure Direct Object Reference IDOR vulnerability that allowed someone with prior Admin access to a Stripe account to add a co-founder to a Stripe Atlas application belonging to the merchant account they used to administer. The issue has been addressed by only allowing...

Unauthorized access vulnerability in NC601B web configuration page of Anhui Kanghai Times Technology Co.

NC601B is a serial port server from Anhui Kanghai Times Technology Co. Ltd. An unauthorized access vulnerability exists in the NC601B web configuration page. An attacker can exploit this vulnerability to obtain critical information about the system, resulting in the disclosure of sensitive...

Logic Flaw Vulnerability in Research Management System of Beijing Eplag Technology Co.

Research management system is a comprehensive management system for research units and management departments to conduct scientific research, and builds a scientific research management system integrating the functions of scientific research information portal, online office and scientific resear...

Rana Android Malware Updates Allow WhatsApp, Telegram IM Snooping

Researchers have discovered new samples of a previously discovered Android malware, which is believed to be linked to the APT39 Iranian cyberespionage threat group. The new variant comes with new surveillance capabilities – including the ability to snoop on victims’ Skype, Instagram and WhatsApp...

SQL Injection Vulnerability in Shanghai Junshang Information Technology Co.

Shanghai Junshang Information Technology Co., Ltd. is committed to providing all kinds of enterprises with website construction, advertising design, software development, network cabling and other professional services. There is a SQL injection vulnerability in Shanghai Junshang Information...

Sixt GmbH & Co. Autovermietung KG: Company Employes Sensitive Information exposed in Android App

Summary: Hi team while analyzing the apk in com.sixt.app.kit.one.manager.share.ShareMockResponseFactory class i found one jwt token and this token upon decoding it revealed certain information about a employee profile of an company who is their ANDROID developer Steps To Reproduce: 1. download th...

Cross site scripting

A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...

CVE-2020-22723

A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...

CVE-2020-22723

CVE-2020-22723 affects Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop, version 1.14. The vulnerability is a cross-site scripting (XSS) flaw that can be triggered via user.php when a user registers in the user center and adds a payload to the delivery address. The NVD entry reports CVSS ...

a4one.co.kr Cross Site Scripting vulnerability OBB-1486219

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass

iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass Vendor: Guangzhou Yeroo Tech Co., Ltd. Product web page: http://www.yerootech.com Affected version: V6.2 B2014.12.12.1220 V5.6 B2017.07.12.1757 V4.3 Summary: iDS6 Software's DSSPro network digital signage management system is a...

iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)

Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery CSRF Date: 2020-07-16 Exploit Author: LiquidWorm Vendor Homepage: http://www.yerootech.com Version: 6.2 iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery CSRF Vendor: Guangzhou Yeroo Tech Co., Ltd...

kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c

A flaw was found in the AMD Cryptographic Co-processor driver in the Linux kernel. An attacker, able to send invalid SHA type commands, could cause the system to crash. The highest threat from this vulnerability is to system availability...

kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c

A flaw was found in the AMD Cryptographic Co-processor driver in the Linux kernel. An attacker, able to send invalid SHA type commands, could cause the system to crash. The highest threat from this vulnerability is to system availability...

ShopsN open source mall system co***_ac*** function SQL injection vulnerabilities exist

ShopsN open source mall system is a product of Shanghai Yiso Network Technology Co., Ltd., a full-featured in line with enterprise-class commercial standards for free commercial use of the open source online store full network system . ShopsN open source mall system coac function exists SQL...