Honor Smartphones Security Breach

Honor Smartphones are a range of smartphones from Chinese company Honor Honor. A security vulnerability exists in Honor Smartphones, which stems from the presence of a privilege assignment error vulnerability, successful exploitation of which may result in an abnormal device service...

Resource Management Error Vulnerability in Huawei CloudEngine 1800V Product (huawei-sa-20201202-01-cloudengine)

CloudEngine 1800V product has a resource management error vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-48394

Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-48388

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48390

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

Code injection

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

Command injection

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command,...

CVE-2023-48390 Multisuns EasyLog web+ - Command Injection

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48388 Multisuns EasyLog web+ - Use of Hard-coded Password

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48388 Multisuns EasyLog web+ - Use of Hard-coded Password

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48376

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

CVE-2023-48374

SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthenticated remote attacker can exploit this vulnerability to run partial processes and obtain partial information, but can't disrupt service o...

CVE-2023-48371

ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service...

CVE-2023-48371

ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service...

Multisuns EasyLog web+ Security Vulnerability

Multisuns EasyLog web+ is an unattended multi-loop digital telephone recording system from Multisuns. A security vulnerability exists in Multisuns EasyLog web+ v1.13.2.8, which can be exploited by remote attackers to break into the code and gain access to the system in order to perform arbitrary...

Rockwell Automation Stratix NTP Authentication doesn't protect symmetric associations against DoS attacks (CVE-2015-1799)

A vulnerability in the authentication code of ntpd could allow an unauthenticated, remote attacker to inject NTP state variables without knowledge of the NTP keys. The vulnerability is due to invalid processing of the NTP packets when authentication fails. An attacker could exploit this...

Buffer Overflows

vlc is vulnerable to Buffer Overflows. A heap-based buffer overflow vulnerability allows an attacker to exploit a flaw in the way that VLC handles RTP packets to cause a buffer overflow. The attacker could then use the buffer overflow to execute arbitrary code on a vulnerable system, steal data, ...

CVE-2023-42669

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in...

Privilege escalation

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVE-2023-41351

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing...