Arbitrary File Download Vulnerability in MPSec ISG1000 Security Gateway of Mapleton Technology Co.

Founded in 1993, Mapletree Technology Co., Ltd. is a leading provider of network products and solutions in China. An arbitrary file download vulnerability exists in the MPSec ISG1000 security gateway of MaplePlus Technology Corporation, which can be exploited by attackers to obtain sensitive...

Command Execution Vulnerability in Next-Generation Firewall Control System of Shenzhen Zhongke NetWei Technology Co.

Ltd. is a national high-tech enterprise, double-soft enterprise; the earliest domestic VPN research and development manufacturers, professional network security product development vendors. Ltd. next-generation firewall control system has a command execution vulnerability, the attacker can use th...

SQL Injection Vulnerability in Cloud Research's Employment Platform

Changsha Yunyan Network Technology Co., Ltd. is an Internet company. A SQL injection vulnerability exists in Cloud Research's employment platform. An attacker can utilize the vulnerability to obtain sensitive database information...

Catalog Traversal Vulnerability in Flash Flood Monitoring and Early Warning System of Beijing Puhua Zhishen Science and Technology Co.

Beijing Puhua Zhishen Technology Co., Ltd, business scope includes technology promotion, basic software services, application software services, etc. A directory traversal vulnerability exists in the flash flood monitoring and early warning system of Beijing Puhua Zhishen Technology Co. An attack...

BokeCad has a binary vulnerability

Shenzhen Bock Times Technology Development Co., Ltd. is a company specializing in the research, development and promotion of garment technology. A binary vulnerability exists in BokeCad, which can be exploited by attackers to gain control of the server...

Weak Password Vulnerability in C-Lodop Print Services System

Ltd. is a company whose main business is software development; information technology consulting services; information system integration services; wholesale of computers, software and auxiliary equipment; retail of computers, software and auxiliary equipment, etc. A weak password vulnerability...

Command Execution Vulnerability in DC of Log Center Platform of DeepTrust Technology Co.

DeepService Technology Co., Ltd. is a product and service provider specializing in enterprise-class security, cloud computing and infrastructure. A command execution vulnerability exists in the DC of the Log Center platform of DeepService Technology Corporation, which can be exploited by an...

Aiven Ltd: Grafana RCE via SMTP server parameter injection

Summary: This report is similar to 1180653, except with different parameter injection entrypoint. SMTP server password configuration setting accepts new line characters. This can be used to set non-exported configuration variables. Using this CRLF-injection, the renderingargs of grafana image...

SQL Injection Vulnerability in Website Building System of Siltronic Ltd.

SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the website buildin...

JVN#13076220: RFNTPS vulnerable to OS command injection

RFNTPS provided by NIPPON ANTENNA Co.,Ltd. is a terrestrial reception type NTP server. RFNTPS contains an OS command injection vulnerability CWE-78. Impact A user on the same LAN who can access the product may execute an arbitrary OS command with root privilege. Solution Update the Firmware Updat...

Command Execution Vulnerability in NETSYS

Founded in 2004, Shenzhen Domain Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, production, sales and service of products in the field of network information security. NETSYS has a command execution vulnerability that can be exploited by an...

CVE-2021-30173 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion

Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file...

CVE-2021-30172 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30170 Jun-He Technology Ltd. ERP POS - Stored XSS-1

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

SQL Injection Vulnerability in Purple File Management System of Purple Software Systems Ltd (CNVD-2021-35784)

Purple Software Systems Ltd. is a company that specializes in making a chain of cloud file management services. A SQL injection vulnerability exists in the Purple File Management System of Purple Software Systems Limited, which can be exploited by attackers to obtain sensitive information from th...

CVE-2020-21999

CVE-2020-21999 affects iWT FaceSentry Access Control System (Firmware 6.4.8, 5.7.x) where an authenticated OS command injection is possible via the strInIP POST parameter in pingTest.php. The vulnerability uses default credentials and executes sudo ping with user-supplied input, enabling arbitrar...

CVE-2020-21999

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script...

PT-2021-10714

Name of the Vulnerable Software and Affected Versions iWT Ltd FaceSentry Access Control System version 6.4.8 Description The issue allows for authenticated OS command injection using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the...

CVE-2020-21999: Improper Neutralization of Special Elements used in an OS Command

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script...

Command Execution Vulnerability in CPE-WiFi of Shenzhen Sidetech Co.

Ltd. is a high-tech enterprise that provides a full line of products required for mainstream access network technology. CPE-WiFi of Shenzhen Sidetech Co., Ltd. has a command execution vulnerability that can be exploited by attackers to execute system commands...