CVE-2019-3977

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system...

CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...

CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...

Code injection

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...

CVE-2019-14413

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets SEC-476...

CVE-2019-14413

CVE-2019-14413 affects cPanel prior to 78.0.2, where an input validation/permissions issue allows certain file-write operations as a shared user during connection resets (SEC-476). Documented by multiple sources (NVD, Red Hat, CNVD, CVE lists) confirms the vulnerability in the cPanel web-based pl...

Slack data breach: Company resets thousands of passwords

By Uzair Amir Slack data breach took place in 2015 but the company became aware of the incident recently through its bug bounty program. Slack has suffered a data breach in which thousands of users have been affected. As a result, the company is resetting passwords of thousands of impacted users...

Telus Actiontec T2200H Serial Number Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Device Details Vendor: Actiontec Telus Branded, but may work on others Model: T2200H Affected Firmware: T2200H-31.128L.08 Device Manual: http://static.telus.com/common/cms/files/internet/telust2200husermanu al.pdf Reported: Sept 2018 CVE: Not needed...

Authentication flaw

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing...

CVE-2018-18995

CVE-2018-18995 affects ABB GATE-E1 and GATE-E2 Gateway Ethernet devices used in Pluto Safety PLC systems. The vulnerability is described as Missing Authentication for Critical Function : administration interfaces (Telnet/Web) accept no authentication, enabling an unauthenticated attacker to acces...

CVE-2018-10633

Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller...

First things first: Envisioning your security deployment

This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...

CVE-2018-7195

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords when an associated e-mail address is known by leveraging guest access and guessing a 6-digit number...

XMSWR-W18 of Shanghai Simmer Communication Technology Co., Ltd. suffers from an override access vulnerability

XMSWR-W18M is an intelligent wireless router from Shanghai Ximo Communication Technology Co. Ltd. XMSWR-W18 suffers from an override access vulnerability that allows an attacker to reset arbitrary devices without authentication...

Integer overflow

Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 have an integer overflow vulnerability. Due to insufficient input validation, an...

Security Advisory - Six Vulnerabilities in Some Huawei Products

There are two out-of-bounds read vulnerability in some Huawei products. Due to insufficient input validation, an authenticated, remote attacker could send malformed SOAP packets to the target device. Successful exploit could make the device access invalid memory and might reset a process...

Debian: Security Advisory (DLA-933-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Friend's Home App Has Logic Design Flaws

Friends Home App is a social B&B platform based on acquaintance relationship. There is a logical design vulnerability in the Friend's Home APP, which can be exploited by an attacker to register arbitrary accounts and reset account passwords, leading to account abuse and consumption of service...

Shanghai HOLLOW Investment Management Co., Ltd APP - HOLLOW Financial has arbitrary number login vulnerability

HOLLOW FINANCE APP is an investment and financing mobile app. Shanghai HaoLu Investment Management Co. HaoLu Financial APP has an arbitrary number login vulnerability, the vulnerability is due to the program failed to limit the number of times the verification code is sent and the valid time. An...

Tripwire IP360 VnE Manager Security Bypass Vulnerability

The Tripwire formerly known as nCircle IP360 VnE Manager is an IT asset management appliance from Tripwire USA. A security vulnerability exists in the RPC service in Tripwire IP360 VnE Manager version 7.2.2 prior to 7.2.6. A remote attacker can exploit the vulnerability with the help of specially...