Code injection

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

CVE-2021-38486 InHand Networks IR615 Router

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions...

CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions...

OTRS 授权问题漏洞

OTRS is an application from the German company OTRS. A service management software. An authorization issue vulnerability exists in OTRS, which arises from a product that allows resources to be locked without Owner rights and can be moved to a queue with rw rights for full control. The following...

IR615 Router authorization issue vulnerability

The IR615 Router is a 4G industrial router from Rimu Technologies of China. The IR615 Router is vulnerable to an authorization issue that could be exploited by an attacker to take full control of the product and execute code on the internal network to which the product is connected...

IR615 Router 授权问题漏洞

The IR615 Router is a 4G industrial router from Rimu Technologies of China. The IR615 Router is vulnerable to an authorization issue that could be exploited by an attacker to take full control of the product and execute code on the internal network to which the product is connected...

CVE-2021-41296

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is an intelligent lighting control solution. ECOA BAS controller has a weak password vulnerability that could be exploited by attackers to gain full control of the system...

CVE-2021-33700

SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of...

Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released

Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The flaws, which were discovered and reported to Netgear by...

The vulnerability of the Server Name Identification (SNI) component of the Cisco Web Security Appliance internet server, the micro-programming software for Cisco Firepower Threat Defense network firewalls, and the intrusion detection systems allows a malicious actor to gain full control over the compromised host and unauthorized access to protected information.

The vulnerability of the Server Name Identification SNI component of the Cisco Web Security Appliance internet server, as well as the micro-programming software for Cisco Firepower Threat Defense and the intrusion detection system Snort, is related to SSL handshake filtering errors. Exploiting th...

Input validation

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP...

CVE-2021-32019

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP...

Command injection

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...

CVE-2021-33534

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2020-27383

Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticat...

Privilege escalation

Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticat...

Privilege escalation

The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability exist due to the improper permissions, with the 'F' flag...