CVE-2021-38549

The CVE-2021-38549 entry concerns MIRACASE MHUB500 USB splitters (affected through 2021-08-09) in specific configurations where the device powers audio-output equipment. The vulnerability arises because the power indicator LED is tied to the power line, making LED brightness correlate with power ...

Command Execution Vulnerability in the Enterprise-Side Internet Integrated Management Platform of Beijing Yahong Century Technology Development Co.

Ltd. is a high-tech company specializing in Internet spatial data governance, network and information security and data value-added solutions and services. A command execution vulnerability exists in the enterprise-side Internet integrated management platform of Beijing Yahong Century Science and...

CVE-2021-34482

No description is available for this CVE...

CVE-2021-38365

The connected documents identify CVE-2021-38365 as affecting ToneWinner (Winner) desktop speakers. The vulnerability allows a remote attacker to recover speech signals from the power-indicator LED using a telescope and an electro-optical sensor, a classically described Glowworm attack. The descri...

CVE-2020-28397

CVE-2020-28397 affects Siemens SIMATIC products due to an incorrect authorization check that could allow an attacker to read information about access-protected PLC variables via port 102/tcp when multiple attributes are read. Affected: SIMATIC Drive Controller family (all versions < V2.9.2); S...

GHSA-H563-XH25-X54Q Workflow re-write vulnerability using input parameter

Impact Allow end-users to set input parameters, but otherwise expect workflows to be secure. Patches Not yet. Workarounds Set EXPRESSIONTEMPLATES=false for the workflow controller References https://github.com/argoproj/argo-workflows/issues/6441 For more information If you have any questions or...

hw: improper isolation of shared resources in some Intel Processors

Microcode misconfiguration in some Intel processors may cause EIBRS mitigation CVE-2017-5715 to be incomplete. As a consequence, this issue may allow an authenticated user to potentially enable information disclosure via local access...

ASP.NET ViewState Not Encrypted

The ViewState is a parameter specific to the ASP.NET framework, it's used as a breadcrumb trail when the user navigates the application preserving values and controls between different web pages. Present on the pages in the viewstate parameter, all the values are serialized and encoded in base64 ...

ASP.NET ViewState MAC Not Enabled

The ViewState is a parameter specific to the ASP.NET framework, it's used as a breadcrumb trail when the user navigates the application preserving values and controls between different web pages. Present on the pages in the viewstate parameter, all the values are serialized and encoded in base64 ...

Weak password vulnerability in SRG3230 of Huawei Technologies Co.

Huawei Technologies Co. Ltd. is an ICT information and communications infrastructure and smart terminal provider. A weak password vulnerability exists in Huawei Technologies Co Ltd SRG3230, which can be exploited by attackers to obtain sensitive information...

CVE-2021-3678

CVE-2021-3678 affects the showdoc project (star7th/showdoc) with a cryptographically weak PRNG. Connected sources (GHSA, Red Hat, OSV, CVE lists) consistently describe usage of insecure randomness (e.g., MD5-based/low-entropy paths, time/rand reliance) as the root cause. Impact details in the ref...

Beers with Talos, Ep. #108: Kaseya it ain't so

Beers with Talos BWT Podcast episode No. 108 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. Who needed a summer vacation anyway? The whole Beers... This is only the...

CVE-2020-19304

CVE-2020-19304 affects MetInfo v7.0.0. The issue is a directory traversal in the endpoint /admin/index.php?n=system&c=filept&a=doGetFileList, allowing access to sensitive data. No additional exploit details are provided in the connected documents, and remediation steps (patch versions/workarounds...

CVE-2021-33333

The CVE-2021-33333 entry describes a vulnerability in the Portal Workflow module of Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 6, where improper permission checks allow remote authenticated users to view and delete wor...

CVE-2021-36763

creationtimestamp| type| source ---|---|--- 2021-08-03 20:28:48+00:00| seen| https://t.me/cibsecurity/26757 2026-03-17 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01...

CVE-2021-33485

The CVE-2021-33485 entry affects CODESYS Control Runtime System prior to version 3.5.17.10, where a heap-based buffer overflow is reported. Public sources consistently describe the vulnerability as a remote condition in the CODESYS Control Runtime, with the NVD metrics indicating network-based ac...

UVI-2021-1001215 dm btree remove: assign new_root only when removal succeeds

dm btree remove: assign newroot only when removal succeeds This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.3 by commit...

CVE-2021-27495

CVE-2021-27495 affects Ypsomed mylife Cloud and mylife App: the system reflects the user password during login after redirecting from HTTPS to HTTP. Affected versions are mylife Cloud all versions before 1.7.2 and mylife App all versions before 1.7.5. The issue is due to improper handling of cred...

CVE-2021-37743

CVE-2021-37743 affects MISP 2.4.147. The vulnerability is a Stored XSS in the view path app/View/GalaxyElements/ajax/index.ctp when rendering galaxy cluster elements in JSON format. The underlying issue is that user-supplied data is reflected in JSON output without proper sanitization, enabling s...

NSA Releases Guidance on Securing Wireless Devices While in Public

The National Security Agency NSA has released an information sheet with guidance on securing wireless devices while in public for National Security System, Department of Defense, and Defense Industrial Base teleworkers, as well as the general public. This information sheet provides information on...