CVE-2021-22857 ChanGate EnterPrise Co., Ltd property management system - Directory Traversal

The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily...

CVE-2021-22858 ChanGate EnterPrise Co., Ltd property management system - Broken Authentication

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

Who is to blame for the malicious Barcode Scanner that got on the Google Play store?

In our last blog, Barcode Scanner app on Google Play infects 10 million users with one update, we wrote about a barcode scanner found on the Google Play store that was infected with Android/Trojan.HiddenAds.AdQR. All initial signs led us to believe that LavaBird LTD was the developer of this...

Barcode Scanner app on Google Play infects 10 million users with one update

UPDATE: February 12, 2021 It has come to our attention that there is another bad actor in this story. Apparently, the original publisher, LAVABIRD LTD, is not the bad actor. It is instead an account under the name "The space team." Nevertheless, there is evidence that updates of Barcode Scanner b...

Memory Corruption Vulnerability in PM Designer of Pingtone Technology Co.

Ltd. is a professional HMI manufacturer headquartered in Taiwan that integrates R&D, production, manufacturing and sales. A memory corruption vulnerability exists in PM Designer, which can be exploited by attackers to cause the program to crash...

JVN#98115035: Android App "ELECOM File Manager" vulnerable to directory traversal

Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Impact A remote attacker may create an arbitrary file or overwrite an existing file in a directo...

CVE-2020-27269

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications lacks replay protection measures, which allows unauthenticated, physically proximate attackers to replay communication sequences...

CVE-2020-27269

CVE-2020-27269 affects Dana Diabecare RS, AnyDana-i, and AnyDana-A insulin pumps and their mobile apps. The root cause is the absence of replay protection in the Bluetooth Low Energy communication protocol, enabling unauthenticated, physically proximate attackers to replay legitimate sequences. P...

Code injection

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low...

CVE-2020-27258

The CVE-2020-27258 issue affects SOOIL Dana Diabecare RS pumps and the AnyDana-i/AnyDana-A mobile apps. It is an information-disclosure vulnerability in the BLE communication protocol that allows unauthenticated attackers within Bluetooth proximity to extract the pump keypad lock PIN. Public sour...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

CVE-2020-27276

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate...

SQL Injection Vulnerability in Dongsheng Logistics Software of Qingdao Dongsheng Weiye Software Co. Ltd (CNVD-2021-08484)

Qingdao Dongsheng Weiye Software Co., Ltd. was founded in November 2004, the company's main business expanded into three major segments, namely, logistics consulting, logistics information platform and logistics software. A SQL injection vulnerability exists in Qingdao Dongsheng Weiye Software Co...

CVE-2018-8726

K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

Design/Logic Flaw

K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges local...

Buffer overflow

K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

CVE-2018-9333

K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: K7TSMngr.exe...

CVE-2018-9332

K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges local...

Information Disclosure Vulnerability in Shentong's Large General Database

Tianjin Shenzhou General Data Technology Co., Ltd referred to as "Shenzhou General", belongs to China Aerospace Science and Technology Corporation CASC. It is a professional company engaged in the research and development of databases, big data solutions and data mining analysis products in China...

Command Execution Vulnerability in CMCC R3S-3 at CMCC Ltd (CNVD-2021-05104)

The CMCC R3S-3 is a router. A command execution vulnerability exists in the CMCC R3S-3 of CMCC IoT Ltd. An attacker can exploit the vulnerability to perform remote code execution as root on the device...