charlesmuddleltd.co.uk Improper Access Control vulnerability OBB-2414624

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SQL Injection Vulnerability in Website Building System of Siltronic Technology Limited (CNVD-2022-25679)

Siltronic is a company dedicated to the cause of disaster prevention and mitigation in China, providing the government with comprehensive solutions for disaster prevention and mitigation informatization. A SQL injection vulnerability exists in the website builder system of Siltronic Technology...

Digging into HermeticWiper

Digging into HermeticWiper By Max Kersten · March 2, 2022 A special thanks to Marc Elias for his help during my analysis. Additionally, I’d like to commend all researchers who have publicly shared their initial findings to help incident response teams; I hope this deep dive contributes to a furth...

Stack Overflow Vulnerability in TL-WDR7660 by P&L Technologies Ltd.

The TL-WDR7660 is a router. A stack overflow vulnerability exists in the P&L Technologies TL-WDR7660, which can be exploited by an attacker to gain server privileges...

File Upload Vulnerability in BossCMS

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A file upload vulnerability exists in BossCMS, which can be exploited by attackers to gain control of the server...

Denial of Service Vulnerability in GBase 8a at Tianjin Nanda General Data Technology Co. Ltd (CNVD-2022-19526)

GBase 8a is a secure database management system with full intellectual property rights. A denial-of-service vulnerability exists in GBase 8a of Tianjin Nanda General Data Technology Company Limited, which can be exploited by attackers to cause a denial-of-service attack...

baldwinltd.ca Cross Site Scripting vulnerability OBB-2379894

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-21727)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Weak Password Vulnerability in InforSuite AS of CCTC Commercial Middleware Co.

Ltd. is a middleware technology research and product development company. A weak password vulnerability exists in InforSuite AS, which can be exploited by attackers to gain access to the server...

File Upload Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd (CNVD-2022-16622)

Siltronic is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. A file upload vulnerability exists in the Flash Flood Monitoring and Early Warning System of Sicron Technology Co. Ltd, which can be exploited by attackers to gain control of the serv...

Logic Flaw Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Technology Limited (CNVD-2022-16618)

Siltronic Ltd. is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. A logic flaw vulnerability exists in the Flash Flood Monitoring and Early Warning System of Siltronic Technology Limited, which can be exploited by attackers to obtain sensitive...

File Upload Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd (CNVD-2022-16625)

Siltronic Ltd. is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. A file upload vulnerability exists in the Flash Flood Monitoring and Early Warning System of Sicron Technology Co. Ltd, which can be exploited by attackers to gain control of the...

GHSA-65MJ-7C86-79JF Authentication Bypass in ADOdb/ADOdb

Impact An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes. Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc. Patches...

Aiven Ltd: 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .

Disclaimer To triage, please note that this is still a 0-day that was alerted to Grafana already, in order to make sure the client is safe I report this issue now, please make sure to not spread it further or leak it, as the best interest is to let you be aware and safer from any potential attack...

Arbitrary File Read Vulnerability in Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd.

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. An arbitrary file read vulnerability exists in the Flash Flood Monitoring and Warning Platform of Sicron Technology Limited, which can be exploited by attackers to obtain sensitive information...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd (CNVD-2022-10323)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Limited, which can be exploited by attackers to gain control of the server...

CVE-2022-22055 Le-yan Co., Ltd. dental management system - SQL Injection

The Le-yan dental management system contains an SQL-injection vulnerability. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to acquire administrator’s privilege and perform arbitrary operations on the system or disrupt service...

Weak Password Vulnerability in CCTC Application Server Software of Shandong CCTC Software Commercial Middleware Co.

Ltd. is a national basic software middleware backbone enterprise. Ltd. is a national basic software middleware enterprise. There is a weak password vulnerability in CCTC application server software, which can be exploited by attackers to obtain sensitive information...

JVN#19826500: PASSWORD MANAGER "MIRUPASS" PW10 / PW20 missing encryption

PASSWORD MANAGER "MIRUPASS" PW10 / PW20 provided by KING JIM CO.,LTD. contain a missing encryption vulnerability CWE-311. Impact A user who can physically access the products may obtain the stored passwords. Solution Stop using the products The developer states that the products are no longer...

CVE-2021-45917 SUN & MOON RISE CO., LTD. Shockwall - Improper Authentication

The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery SSRF attack on another agent computer,...