Hillrom Welch Allyn Cardio Products

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Hillrom Equipment: Welch Allyn Cardio Products Vulnerability: Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access...

Hitachi Energy GMS600, PWC600, and Relion

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: GMS600, PWC600, and Relion 670/650/SAM600-IO Vulnerability: Improper Access Controls 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

DEBIAN-CVE-2021-36133

The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a DMA capable peripheral...

CVE-2021-37091

There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to confidentiality affected...

CVE-2021-37091

There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to confidentiality affected...

CVE-2021-37058

There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user's nickname is maliciously tampered with...

CVE-2021-37058

There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user's nickname is maliciously tampered with...

USN-5178-1: Django vulnerability

Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled URLs with trailing newlines. A remote attacker could possibly use this issue to bypass certain access controls...

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge is related to deficiencies in system-defined boundary controls. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially creat...

The vulnerability of the ColdFusion software platform, related to the use of initially dangerous functions, allows attackers to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and gain unauthorized access to protected information...

Johnson Controls exacqVision Server Information Disclosure Vulnerability

Johnson Controls exacqVision Server is a surveillance video management software from Johnson Controls, a U.S. company. Johnson Controls is vulnerable to an information disclosure vulnerability that stems from excessive data output from the application. An attacker could use this vulnerability to...

What Are Your Top Cloud Security Challenges? Threatpost Poll

There are myriad reasons that organizations are moving en masse to the cloud: Digital transformation, the ability to be more agile, cost reduction, better collaboration and productivity, and, in these pandemic times, a better ability to support remote working. Cybercriminals are moving to the clo...

Johnson Controls exacqVision Server 信息泄露漏洞

Johnson Controls exacqVision Server is a surveillance video management software from Johnson Controls, a U.S. company. Johnson Controls is vulnerable to an information disclosure vulnerability that stems from excessive data output from the application. An attacker could use this vulnerability to...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

Distributed Data Systems WebHmi 授权问题漏洞

Distributed Data Systems WebHmi is a Scada system with a built-in web server from Distributed Data Systems, Ukraine. It is used for monitoring and controlling any automation system on the local network as well as over the Internet from computers and mobile devices. Distributed Data Systems WebHmi...

Johnson Controls Entrapass

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: Entrapass Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION Successful exploitation of this...

Capcom Arcade Stadium’s record player numbers blamed on card mining

Some of my favourite retro video games are making waves on Steam, but not in the way you might think. Classics such as Strider, Ghosts n’ Goblins, and more are all available as content for Capcom Arcade Stadium. This is an emulator which lets you play 31 arcade games from the 80s/90s. The games...

PT-2021-23540 · Unknown · Topease Platform

Name of the Vulnerable Software and Affected Versions: TopEase Platform versions prior to 7.1.28 Description: The issue allows an authenticated remote attacker to bypass access controls and view sensitive components, such as the Shape Editor and Settings, which are intended for higher-privileged...

Johnson Controls CEM Systems AC2000

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Controlled Electronic Management Systems, Ltd., a subsidiary of Johnson Controls, Inc. Equipment: CEM Systems AC2000 Vulnerability: Off-by-one Error 2. RISK EVALUATION Successful exploitation of this vulnerability could...

CVE-2021-43783

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...