CVE-2021-27571

CVE-2021-27571 affects Emote Remote Mouse up to version 4.0.0.0. The issue allows an attacker to retrieve recently used and running applications, their icons, and their file paths. The data is sent in cleartext and not protected by any authentication logic. Connected documents confirm the affecte...

CVE-2021-27569

CVE-2021-27569 affects Emote Remote Mouse (up to version 4.0.0.0). Red Hat and CNVD entries confirm a vulnerability where an attacker can maximize or minimize a running process window by sending the process name in a crafted packet. The issue is transmitted in cleartext and lacks authentication p...

GHSA-9P9M-JM8W-94P2 Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

Impact A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. Patches Version 0.31.0 restricts websocket frame to reasonable limits. Workarounds Restricting memory usa...

CVE-2021-32077

CVE-2021-32077 – VerityStream MSOW Solutions : A information disclosure vulnerability affects versions prior to 3.1.1, allowing an anonymous user to brute-force a (sometimes hidden) search field where the last four SSN digits are included in the supported selectors. This enables disclosure of doc...

CVE-2021-28151

Hongdian H8922 3.0.5 devices are vulnerable to remote command injection in tools.cgi ping via shell metacharacters in the ip-address (Destination) field, accessible with guest/guest credentials. The Nuclei template and other sources confirm that an attacker can execute arbitrary commands on the d...

CVE-2021-29491

The CVE-2021-29491 entry concerns the mixme package for Node.js. Affected version: 0.5.0 (and earlier) allows an attacker to add or alter object properties via proto /proto in mutate/merge, enabling prototype pollution and potential DoS. The issue is fixed in version 0.5.1; upgrading to 0.5.1 or ...

CVE-2021-1530

CVE-2021-1530 – Cisco BroadWorks Messaging Server XML External Entity (XXE) Injection . Affects Cisco BroadWorks Messaging Server Software; vulnerability arises from improper handling of XXE in XML parsing. An authenticated, remote attacker could retrieve local files or cause a partial DoS. Publi...

CVE-2020-28025

Exim 4 prior to 4.94.2 is affected by CVE-2020-28025 (Out-of-bounds Read). The flaw is due to pdkim_finish_bodyhash not validating the relationship between sig->bodyhash.len and b->bh.len, which can allow leakage of sensitive information from process memory via a crafted DKIM-Signature head...

SQL Injection Vulnerability in jfinal cms Backend

jfinal cms is a java developed information and counseling website. A SQL injection vulnerability exists in the backend of jfinal cms. An attacker can exploit the vulnerability to obtain sensitive database information...

Command Execution Vulnerability in EG2000SE of Riptide Networks Inc.

Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products, storage, and more. A command execution vulnerability exists in Ruijie Networks Corporation's EG2000SE,...

Human Resource Information System 1.0 Authentication Bypass / Account Creation Exploit

Exploit Title: Human Resource Information System 1.0 - Create Admin Account Unauthenticated Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14714/human-resource-information-using-phpmysqliobject-orientedcomplete-free-sourcecode.html Version:1.0 Tested on: windows...

Over 40 Apps With More Than 100 Million Installs Found Leaking AWS Keys

Most mobile app users tend to blindly trust that the apps they download from app stores are safe and secure. But that isn't always the case. To demonstrate the pitfalls and identify vulnerabilities on a large scale, cybersecurity and machine intelligence company CloudSEK recently provided a...

Integer overflow in CipherUpdate

Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 indicating succes...

ASB-A-172349029

Bulletin has no description...

A Tale of Two Hacks: From SolarWinds to Microsoft Exchange

The past four months have exposed two high-profile attacks, which both had pundits declaring them the “worst-ever” and “unprecedented.” They shared other similarities – both attacked businesses rather than individuals, and affected tens of thousands of organizations. But that is where the...

Serious MacOS Vulnerability Patched

Apple just patched a MacOS vulnerability that bypassed malware checks. The flaw is akin to a front entrance thats barred and bolted effectively, but with a cat door at the bottom that you can easily toss a bomb through. Apple mistakenly assumed that applications will always have certain specific...

Weak Password Vulnerability in OfficeTen Management System of NetEconomy Technology (Suzhou) Co.

OfficeTen Management System of NetEconomy Technology Suzhou Co., Ltd. is an integrated information system that provides personalized services to customers. A weak password vulnerability exists in the OfficeTen management system of NetEconomy Technology Suzhou Co., Ltd. that can be exploited by...

Weak password vulnerability in Archer C50 routers

hereinafter referred to as "TP-LINK" is a leading global supplier of network communication equipment. A weak password vulnerability exists in the Archer C50 router, which can be exploited by attackers to obtain sensitive information...

Xionghai CMS suffers from SQL injection vulnerability (CNVD-2021-35840)

Xionghai CMS is a set of comprehensive website management system that can be widely used for personal blogs, personal websites and corporate websites. XIONGHAI CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2020-7037

The provided connected documents confirm CVE-2020-7037 is an XML External Entities (XXE) vulnerability in the Media Server component of Avaya Equinox Conferencing (now Avaya Meetings Server). The issue affects all 9.x versions prior to 9.1.11 , and an authenticated, remote attacker could read inf...