PT-2021-5058

Name of the Vulnerable Software and Affected Versions Yealink Device Management version 3.6.0.20 Description The issue is related to a lack of input data sanitization in the Yealink Device Management platform, allowing a remote attacker to execute arbitrary commands as the root user. Specifically...

Weak Password Vulnerability in Huawei's USG Firewall

Huawei USG Firewall is a firewall from Huawei for small businesses, branch offices, sales outlets, community service stations, and other scenarios. Huawei USG Firewall suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Logic Flaw Vulnerability in Qixing Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is developed based on Qixing ISE unified engine, there is no OEM from third-party functions, and the functions can be split in any combination, which has very little impact on system performance. Adopting multi-core hardware architecture and integrated software design,...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

Design/Logic Flaw

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares...

CVE-2020-36249

The CVE-2020-36249 case concerns OwnCloud File Firewall (pre-2.8.0) failing to enforce file-type restrictions on public shares. Affected product is ownCloud Server’s File Firewall component; the root cause is described as improper enforcement of shared-file type restrictions. Public shares could ...

Owncloud File Firewall 安全漏洞

OwnCloud OwnCloud is a personal cloud storage solution from OwnCloud Owncloud, an American company. A security vulnerability exists in OwnCloud File Firewall that stems from the system failing to properly enforce public shared file type restrictions. No details of the vulnerability are available ...

Weak Password Vulnerability in Founder Firewall WEB Login

Founder Group was invested and founded by Peking University in 1986. Academician Wang Xuan was the technical decision maker and founder of Founder Group, and his invention of Chinese character laser phototypesetting technology laid the foundation of Founder Group. A weak password vulnerability...

Weak Password Vulnerability in Jabil Firewall Management System, Jabil SSLVPN Management System, Jabil Website Security Monitoring

Xi'an Jiaotong University Jiepu Network Technology Co., Ltd. is a first-class professional network security products and technology provider in China. Jabil Firewall Management System, Jabil SSLVPN Management System, Jabil Website Security Monitoring has a weak password vulnerability that can be...

Monitor Google Cloud Platform (GCP) Data With InsightIDR

InsightIDR was built in the cloud to support dynamic and rapidly changing environments—including remote workers, hybrid cloud and on-premises architectures, and fully cloud environments. Today, more and more organizations are adopting multi-cloud or hybrid environments, creating increasingly more...

SolarWinds Hack and the Case of DNS Security

It's not news that some of the top government agencies and companies in the world were victims of the SolarWinds attack. At this point, I can say it's the reason I didn't have a smoother transition back into work-life following a long vacation. As I understand it, the breaches happened after...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

Design/Logic Flaw

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-27201

CVE-2021-27201 affects Endian Firewall Community (EFW) 3.3.2. The vulnerability allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. The connected sources (NVD, Red Hat, CVE listing) confirm the issue; no remediation details are provided...

CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...