KevinLAB BEMS 1.0 Undocumented Backdoor Account Vulnerability

KevinLAB BEMS version 1.0 has an undocumented backdoor account and the sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with...

Security Bulletin: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could affect IBM InfoSphere Optim Performance Manager CVE-2017-10115 CVE-2017-10116

Summary An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors, and allow an unauthenticated...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10035)

Insyde H2OFFT is a set of tools for BIOS firmware development from Insyde Software Taiwan, China.Insyde InsydeH2O has a security vulnerability that could be exploited by attackers to gain control of the system via system administration mode privileges...

CISA Releases Advisory on ZOLL Defibrillator Dashboard

CISA has released an Industrial Controls Systems ICS Medical Advisory on multiple vulnerabilities in the ZOLL Defibrillator Dashboard. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the ICS...

Microsoft Releases June 2021 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s June 2021 Security Update Summary and...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Adobe’s Security Bulletins and apply the necessary updates...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages...

Microsoft Releases May 2021 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s May 2021 Security Update Summary and Deployme...

 Cisco Releases Security Updates for Multiple Products 

Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...

CVE-2020-21997

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

Information disclosure

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

CVE-2020-21997

Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...

CVE-2020-21997

Smartwares HOME easy

Smartwares Home Easy 访问控制错误漏洞

Smartwares Home Easy is an application from Smartwares USA. Comfortably control home devices from your iPhone or Android smartphone using a remote outlet An access control error vulnerability exists in Smartwares HOME easy version 1.0.9 and prior versions, which stems from susceptibility to...

CVE-2021-21224

Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Recent assessments: gwillcox-r7 at June 17, 2021 3:06pm UTC reported: According to...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Multiple Oracle database server security vulnerabilities affect IBM Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2021-2045 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to...

CVE-2021-22665

Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system...

CVE-2021-22665

CVE-2021-22665 affects Rockwell Automation DriveTools SP (v5.13 and below) and Drives AOP (v4.12 and below), where an attacker with limited local privileges can exploit an Uncontrolled Search Path Element (CWE-427) to escalate privileges and gain complete control of the system. The Red Hat/NVD/IC...

nodejs: DNS rebinding in --inspect

A flaw was found in nodejs. A denial of service is possible when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS over the network. If the attacker controls the victim's DNS server or can spoof its response...

Mozilla Releases Security Updates for Thunderbird, Firefox ESR, and Firefox

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisories for Firefox 86,...