Command Execution Vulnerability in CPE-WiFi of Shenzhen Sidetech Co.

Ltd. is a high-tech enterprise that provides a full line of products required for mainstream access network technology. CPE-WiFi of Shenzhen Sidetech Co., Ltd. has a command execution vulnerability that can be exploited by attackers to execute system commands...

Weak password vulnerability in TP-LINK TL-WR743ND router

P&T Technologies Ltd. is a leading global provider of network communication equipment. A weak password vulnerability exists in the TL-WR743ND router, which can be exploited by an attacker to log into the system backend and perform unauthorized operations...

Weak Password Vulnerability in PA-5500-U06 of Humber Technology Ltd.

English: Opzoon is a leading global provider of cloud computing data center solutions and the first high-tech enterprise in China to establish an enterprise-level applied mathematics laboratory. A weak password vulnerability exists in Humber Technology Limited PA-5500-U06, which can be exploited ...

Anhui Xufan Information Technology Co., Ltd. EASYGBS exists logic flaw vulnerability

Anhui Xufan Information Technology Co., Ltd. was established on August 11, 2014 . Legal representative Cai Kunsong, the company's scope of business includes: computer hardware and software development and sales, technical services, technical consulting, technology transfer; web page design; netwo...

SQL Injection Vulnerability in the Website Building System of Beijing Bolehoo Technology Co. Ltd (CNVD-2021-26012)

Beijing Bleihoo Technology Co., Ltd. is a planning, design, production, technology development in one of the oldest website building company. There is a SQL injection vulnerability in the website builder system of Beijing Bleihoo Technology Co., Ltd, which can be exploited by attackers to obtain...

Command Execution Vulnerability in e-mobile

e-mobile is a mobile office product developed by Shanghai Panmicro Networks Technology Co., Ltd. and is specially designed for cell phone, tablet PC and other mobile terminal users to create a mobile office product. A command execution vulnerability exists in e-mobile, which can be exploited by a...

Stored XSS Vulnerability in TongWeb Management Console at Beijing Orientop Technology Co.

TongWeb is an application server from Beijing Orientop Technology Co. A stored XSS vulnerability exists in the TongWeb management console of Beijing Oriental Tong Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information such as user cookies...

Weak Password Vulnerability in TL-WR841HP of P&L Technology Ltd.

The TL-WR841HP is a 300Mbps, high power wireless router. A weak password vulnerability exists in the P&T TL-WR841HP, which can be exploited by an attacker to obtain sensitive information...

Unauthorized Access Vulnerability in TongWeb Management Console of Beijing Orientop Technology Co.

TongWeb is an application server from Beijing Orientop Technology Co. An unauthorized access vulnerability exists in the TongWeb management console of Beijing Oriental Tong Technology Co. Ltd. that can be exploited by attackers to obtain sensitive information...

SOYAL 701Client 9.0.1 Insecure Permissions

Summary 701 Client is the user interface software for the access control system. It is used for adding and deleting tokens, setting door groups for access, setting time zones for limiting access and monitoring ingress and egress on a live system, among other things. Description The application...

WordPress WP Hotel Booking plugin <= 1.10.2 - Unauthenticated Remote Code Execution (RCE) via Arbitrary Object Deserialisation vulnerability

Unauthenticated Remote Code Execution RCE via Arbitrary Object Deserialisation vulnerability discovered by Nick Blundell AppCheck Ltd in WordPress WP Hotel Booking plugin versions = 1.10.2. Solution Update the WordPress WP Hotel Booking plugin to the latest available version at least 1.10.3...

JVN#66542874: Multiple cross-site scripting vulnerabilities in Movable Type

Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability in Role authority setting screen CWE-79 - CVE-2021-20663 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base...

Buffer overflow

Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a crafted input that will overwrite the SEH handler...

JVN#37417423: Multiple vulnerabilities in SolarView Compact

SolarView Compact provided by Contec Co., Ltd. contains multiple vulnerabilities listed below. Exposure of information through directory listing CWE-548 - CVE-2021-20656 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N| Base Score: 3.5 CVSS v2|...

Weak Password Vulnerability in Jabil Firewall Management System, Jabil SSLVPN Management System, Jabil Website Security Monitoring

Xi'an Jiaotong University Jiepu Network Technology Co., Ltd. is a first-class professional network security products and technology provider in China. Jabil Firewall Management System, Jabil SSLVPN Management System, Jabil Website Security Monitoring has a weak password vulnerability that can be...

CVE-2021-22857 ChanGate EnterPrise Co., Ltd property management system - Directory Traversal

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...

CVE-2021-22858 ChanGate EnterPrise Co., Ltd property management system - Broken Authentication

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

Who is to blame for the malicious Barcode Scanner that got on the Google Play store?

In our last blog, Barcode Scanner app on Google Play infects 10 million users with one update, we wrote about a barcode scanner found on the Google Play store that was infected with Android/Trojan.HiddenAds.AdQR. All initial signs led us to believe that LavaBird LTD was the developer of this...

Barcode Scanner app on Google Play infects 10 million users with one update

UPDATE: February 12, 2021 It has come to our attention that there is another bad actor in this story. Apparently, the original publisher, LAVABIRD LTD, is not the bad actor. It is instead an account under the name "The space team." Nevertheless, there is evidence that updates of Barcode Scanner b...

Memory Corruption Vulnerability in PM Designer of Pingtone Technology Co.

Ltd. is a professional HMI manufacturer headquartered in Taiwan that integrates R&D, production, manufacturing and sales. A memory corruption vulnerability exists in PM Designer, which can be exploited by attackers to cause the program to crash...