CVE-2017-8228

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the...

CVE-2019-6971

An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interface, and fully control the router without knowledge of the credentials...

Malicious Module

bowee has a malicious module in the form of a preinstall script. The script gets a backdoor file from a remote server and executes it, subsequently giving full control of the computer to an external malicious entity...

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system allows a hacker to gain full control over the application.

The vulnerability of the Portable Clusterware component of the Oracle Database Server management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Windows DLL component of the Oracle Java SE software platform allows a perpetrator to gain full control over the application.

The vulnerability of the Windows DLL component of the Oracle Java SE software platform is related to access control deficiencies. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application through network protocols...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool is related to lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of the Connector/J sub-component of the MySQL Connectors component of the Oracle MySQL database management system allows a hacker to gain full control over the application.

The vulnerability of the Connector/J sub-component of the MySQL Connectors component of the Oracle MySQL database management system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the application using the JDBC protocol...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of Oracle VM VirtualBox is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

The vulnerability of Oracle Java SE’s 2D software platform allows a hacker to gain full control over the application.

The vulnerability of the Oracle Java SE 2D software platform is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the application...

The vulnerability of the Core component of the Oracle VM VirtualBox virtualization tool, which allows a hacker to gain full control over the application

The vulnerability of the Core component of Oracle VM VirtualBox is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2019-9733

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a...

GOG Galaxy Games directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s “Games” directory. An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. Tested Versions Gog...

GOG Galaxy updater temp directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s Temp directory. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges. Tested Versions...

Command Execution Vulnerability in Qiji Transportation and Maintenance Bastion Machine

Qiji Technology is the creator and leader of Fortress Ops Platform / Ops Audit, and is the only vendor in China that specializes in the field of Ops Management. After installing ShtermClient-2.1.1.exe, the Qiji Ops Fortress client software registers a customized protocol shterm on a personal...

CVE-2018-18435

KioWare Server version 4.9.6 and older installs by default to "C:\kiowarecom" with weak folder permissions granting any user full permission "Everyone: F" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as...

Moxa IKS and EDS predictable cookie vulnerabilities

Moxa IKS and EDS is a series of industrial switches introduced by Moxa. A predictable cookie vulnerability exists in the Moxa IKS and EDS series. The vulnerability stems from software that generates a predictable cookie calculated using MD5 hashing, which can be exploited by an attacker to captur...

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain unauthorized access to protected data.

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP protocol...

The vulnerability of the Xenvironment component in the Oracle Retail Xstore Point of Service software allows a perpetrator to gain full control over the application.

The vulnerability of the Xenvironment component in the Oracle Retail Xstore Point of Service software is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP protocol...

The vulnerability of the Query component in the PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain unauthorized access to protected data.

The vulnerability of the Query component in the PeopleSoft Enterprise PeopleTools business application suite is related to insufficient access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP protocol...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain control over the application.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...