1776 matches found
Hardcoded credentials
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...
CVE-2023-38027 SpotCam Co., Ltd. SpotCam Sense - Command Injection
SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service...
CVE-2023-38026 SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...
CVE-2023-38026 SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...
CVE-2023-38025
The CVE-2023-38025 entry concerns SpotCam FHD 2 where a vulnerability in the device’s hidden Telnet function allows OS command injection. Attack requires network access and no authentication, enabling a remote attacker to execute arbitrary system commands or disrupt service. The public documents ...
CVE-2023-38024 SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...
Arbitrary File Read Vulnerability in DPtech SSL VPN of Hangzhou Dipu Technology Co.
Ltd. is a high-tech enterprise integrating R&D, production and sales in the field of network, security and application delivery. Ltd. DPtech SSL VPN suffers from an arbitrary file read vulnerability, which can be exploited by attackers to obtain sensitive information...
CVE-2023-39807
N.V.K.INTER CO., LTD. NVK iBSG v3.5 was discovered to contain a SQL injection vulnerability via the apasswd parameter at /portal/user-register.php...
Command injection
N.V.K.INTER CO., LTD. NVK iBSG v3.5 was discovered to contain a command injection vulnerability via the systemhostname parameter at /manage/network-basic.php...
CVE-2023-39807
CVE-2023-39807 affects N.V.K. INTER CO., LTD. iBSG v3.5. The vulnerability is a SQL injection via the a_passwd parameter in the /portal/user-register.php endpoint, enabling potential unauthorized data access or manipulation. The CVSS v3.1 metrics indicate a high-severity, network-exposed issue wi...
CVE-2023-39809
N.V.K.INTER CO., LTD. NVK iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the systemhostname parameter at /manage/network-basic.php...
CVE-2023-39808
CVE-2023-39808 affects N.V.K. INTER iBSG v3.5. The vulnerability stems from a hardcoded root password, enabling an attacker to log in with root privileges over SSH. Public sources corroborate the issue and assign a high severity (CVSSv3.1: 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No exploitatio...
Command Execution Vulnerability in TL-FW5600 and TL-FW6300 of P&L Technologies Ltd.
The TL-FW5600 and TL-FW6300 are firewall products from P&L Technologies. A command execution vulnerability exists in the TL-FW5600 and TL-FW6300 from P&L Technologies Ltd. that can be exploited by an attacker to execute arbitrary system commands...
Unauthorized Access Vulnerability in River Management System of Siltronic Ltd.
Siltronic is a China-based information service provider for disaster reduction and profitability. An unauthorized access vulnerability exists in the River Management System Management System of Sicron Technology Limited, which can be exploited by attackers to obtain sensitive information...
Remote Code Execution Vulnerability in WPS Office of Zhuhai Kingsoft Office Software Co.
WPS Office is an office software suite from Zhuhai Kingsoft Office Software Co. A remote code execution vulnerability exists in WPS Office of Zhuhai Kingsoft Office Software Co. Ltd, which can be exploited by attackers to gain server privileges...
albertafirstflooringltd.com Cross Site Scripting vulnerability OBB-3566835
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Simple Author Box Plugin < 2.52 is vulnerable to Insecure Direct Object References (IDOR)
Software Simple Author Box Type Plugin Vulnerable versions 2.52 Fixed in 2.52 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-3601 Patch priority Low CVSS severity Low 6.5 Developer WebFactory Ltd. PSID c55453b38919 Credits Dmitriy Require...
Ransomware groups claim responsibility for double-attack on Yamaha
Music giant Yamahas Canadian division has experienced a compromise on two different fronts, both related to ransomware. In an attack which has worrying echoes of the recent Estee Lauder attack, multiple attackers have claimed to breach the organisation. Yamaha Canada Music had the following to sa...
WordPress Simple Author Box Plugin <= 2.3.22 is vulnerable to Cross Site Scripting (XSS)
Software Simple Author Box Type Plugin Vulnerable versions = 2.3.22 Fixed in 2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer WebFactory Ltd. PSID a31be070f305 Credits Rafie Muhammad Patchstack Required...