JVN#98115035: Android App "ELECOM File Manager" vulnerable to directory traversal

Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Impact A remote attacker may create an arbitrary file or overwrite an existing file in a directo...

CVE-2020-27269

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications lacks replay protection measures, which allows unauthenticated, physically proximate attackers to replay communication sequences...

CVE-2020-27269

CVE-2020-27269 affects Dana Diabecare RS, AnyDana-i, and AnyDana-A insulin pumps and their mobile apps. The root cause is the absence of replay protection in the Bluetooth Low Energy communication protocol, enabling unauthenticated, physically proximate attackers to replay legitimate sequences. P...

Code injection

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low...

CVE-2020-27258

The CVE-2020-27258 issue affects SOOIL Dana Diabecare RS pumps and the AnyDana-i/AnyDana-A mobile apps. It is an information-disclosure vulnerability in the BLE communication protocol that allows unauthenticated attackers within Bluetooth proximity to extract the pump keypad lock PIN. Public sour...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

PT-2021-11352

Name of the Vulnerable Software and Affected Versions: SOOIL Developments Co., Ltd Diabecare RS affected versions not specified AnyDana-i affected versions not specified AnyDana-A affected versions not specified Description: The communication protocol of the insulin pump and its mobile applicatio...

SQL Injection Vulnerability in Dongsheng Logistics Software of Qingdao Dongsheng Weiye Software Co. Ltd (CNVD-2021-08484)

Qingdao Dongsheng Weiye Software Co., Ltd. was founded in November 2004, the company's main business expanded into three major segments, namely, logistics consulting, logistics information platform and logistics software. A SQL injection vulnerability exists in Qingdao Dongsheng Weiye Software Co...

CVE-2018-8726

K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

Design/Logic Flaw

K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges local...

Buffer overflow

K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

CVE-2018-9333

K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

CVE-2018-9332

K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges local...

Information Disclosure Vulnerability in Shentong's Large General Database

Tianjin Shenzhou General Data Technology Co., Ltd referred to as "Shenzhou General", belongs to China Aerospace Science and Technology Corporation CASC. It is a professional company engaged in the research and development of databases, big data solutions and data mining analysis products in China...

Command Execution Vulnerability in CMCC R3S-3 at CMCC Ltd (CNVD-2021-05104)

The CMCC R3S-3 is a router. A command execution vulnerability exists in the CMCC R3S-3 of CMCC IoT Ltd. An attacker can exploit the vulnerability to perform remote code execution as root on the device...

Mitsubishi Electric MELSEC iQ-R Series (Update D)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Equipment : MELSEC iQ-R Series Vulnerability : Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a...

CVE-2020-22723

CVE-2020-22723 affects Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop, version 1.14. The vulnerability is a cross-site scripting (XSS) flaw that can be triggered via user.php when a user registers in the user center and adds a payload to the delivery address. The NVD entry reports CVSS ...

JVN#94245475: Movable Type Premium vulnerable to cross-site scripting

Movable Type Premium provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged-in user's web browser. Solution Update the software Update the software to the latest version according to the information provided by the...

About the security content of Safari 14.0.1 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...