July 13, 2021—KB5004294 (Monthly Rollup)

None None...

Cisco BPA, WSA Bugs Allow Remote Cyberattacks

A set of high-severity privilege-escalation vulnerabilities affecting Business Process Automation BPA application and Cisco’s Web Security Appliance WSA and could allow authenticated, remote attackers to access sensitive data or take over a targeted system. The first two bugs CVE-2021-1574 and...

WordPress Server-Side Request Forgery Vulnerability (CNVD-2021-59060)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A server-side request forgery vulnerability exists in the WordPress wp-smart-import plugin. No...

Weak password vulnerability in ZTE smart routers

ZTE Corporation is a leading global provider of integrated communications and information solutions, offering innovative technology and product solutions to telecom operators, government and enterprise customers, and consumers worldwide. A weak password vulnerability exists in ZTE smart routers,...

CVE-2020-24147

Server-side request forgery SSR vulnerability in the WP Smart Import wp-smart-import plugin 1.0.0 for WordPress via the file field...

CVE-2020-24147

Server-side request forgery SSR vulnerability in the WP Smart Import wp-smart-import plugin 1.0.0 for WordPress via the file field...

Server side request forgery (ssrf)

Server-side request forgery SSR vulnerability in the WP Smart Import wp-smart-import plugin 1.0.0 for WordPress via the file field...

CVE-2020-24147

The CVE-2020-24147 entry describes a Server-Side Request Forgery (SSRF) in the WordPress WP Smart Import plugin, version 1.0.0, exploitable via the file field. The issue is documented as affecting WP Smart Import 1.0.0 and is mitigated by upgrading to a newer version (e.g., 1.0.1+), per multiple ...

SQL Injection Vulnerability in Intelligent Park Comprehensive Management Platform of Zhejiang Dahua Technology Co.(CNVD-2021-51488)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. There is a SQL injection vulnerability in the integrated management platform of Zhejiang Dahua Technology Co., Ltd. that can be exploited by an attacker to obtain sensitive...

PT-2021-11018 · WordPress · Wp Smart Import

Name of the Vulnerable Software and Affected Versions: WP Smart Import plugin version 1.0.0 Description: A server-side request forgery SSRF issue exists in the WP Smart Import plugin for WordPress. This issue is related to the file field. Recommendations: For WP Smart Import plugin version 1.0.0,...

Command Execution Vulnerability in Dongying Smart Public Transportation App

Dongying Smart Bus App is a client application that allows you to check bus routes and arrival times in the palm of your hand. Dongying Smart Bus APP has a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...

SQL Injection Vulnerability in Intelligent Park Comprehensive Management Platform of Zhejiang Dahua Technology Co.(CNVD-2021-51489)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. There is a SQL injection vulnerability in the integrated management platform of Zhejiang Dahua Technology Co., Ltd. that can be exploited by an attacker to obtain sensitive...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A server-side request forgery vulnerability exists in the WordPress wp-smart-import plugin. No...

Flash loan risk mitigation is optional and not robust enough

Handle 0xRajeev Vulnerability details Impact The switchEoaOnly allows the owner to disable preventSmartContracts the project’s plan apparently is to do so after the beta-period which will allow any smart contract to interact with the protocol and potentially exploit any underlying flash loan...

Security Bulletin: Multiple vulnerabilities in Apache JSON Small and Fast Parser (json-smart) and Underscore affect IBM Spectrum Symphony

Summary There are multiple vulnerabilities in Apache JSON Small and Fast Parser json-smart and Underscore used by IBM Spectrum Symphony. IBM Spectrum Symphony has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-27568 DESCRIPTION: Netplex json-smart-v1 and json-smart-v2 are...

Amazon Echo Dots Store a Wealth of Data—Even After a Reset

Thinking about selling your smart speaker? Be aware that you can't completely delete personal content from the device...

Talos Takes Ep. #59: How to secure the devices that secure your home network

By Jon Munshaw. As consumers start having more “smart” devices connected to their home network, they may want an easy solution to keeping those devices safe. But what if that device gets owned? Carl Hurd of our vulnerability research team recently discovered several vulnerabilities in Trend...

Unauthorized Access Vulnerability in Xiaodu Routing

Xiaodu Router is a smart router product launched by Baidu, which can transmit cloud data at will and support remote download of audio and video resources. Xiaodu Router has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

Command Execution Vulnerability in Xiaodu Route AV Version

Xiaodu Router is a smart router product launched by Baidu, which can transmit cloud data at will and support remote download of audio and video resources. Xiaodu Router AV version has a command execution vulnerability, which can be exploited by attackers to obtain server control privileges...

Command Execution Vulnerability in Xiaodu Routing

Xiaodu Router is a smart router product launched by Baidu, which can transmit cloud data at will and support remote download of audio and video resources. Xiaodu Router has a command execution vulnerability that can be exploited by attackers to gain control of the server...