CVE-2021-23357 Directory Traversal

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this valu...

Weak password vulnerability in ER3260G2 system administration (CNVD-2021-22501)

ER3260G2 is a new generation of enterprise-grade Gigabit high-performance router from Xinhua San Technologies Co. A weak password vulnerability exists in the system management of ER3260G2, which can be exploited by attackers to obtain sensitive information...

CVE-2021-27246

creationtimestamp| type| source ---|---|--- 2021-03-12 10:58:34+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2882...

Introducing the 2020 Vulnerability Intelligence Report: 50 CVEs that Made Headlines in 2020

2020 was a tumultuous year for vulnerability risk management. Defenders had to contend with a growing volume of high-priority security threats, many of them in internet-facing technologies deployed to enable and secure a suddenly remote workforce. New communications from the U.S. National Securit...

Atlassian JIRA 8.11.1 - User Enumeration Exploit

Title: Atlassian JIRA 8.11.1 - User Enumeration Author: Dolev Farhi Vulnerable versions: version ' print'e.g. python3 script.py https://jiratarget.com usernames.txt' sys.exit if lensys.argv 3: help server = sys.argv1 usernames = sys.argv2 randomuser = '0x00001' try: os.path.existsusernames except...

Dell PowerScale OneFS 操作系统命令注入漏洞

Dell Technologies Dell PowerScale OneFS is an operating system from Dell Technologies, USA. PowerScale OneFS operating system that provides horizontal scaling NAS. An operating system command injection vulnerability exists in PowerScale OneFS 8.1.2,8.2.2 and 9.1.0, which could be exploited by an...

Why do companies fail to stop breaches despite soaring IT security investment?

Let's first take a look back at 2020! Adding to the list of difficulties that surfaced last year, 2020 was also grim for personal data protection, as it has marked a new record number of leaked credentials and PI data. A whopping 20 billion records were stolen in a single year, increasing 66% fro...

Denial of Service Vulnerability in Weilian Technologies WiSCADA (CNVD-2021-21779)

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. A denial of service vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to cause the program to crash...

Denial of Service Vulnerability in Weilian Technologies WiSCADA (CNVD-2021-21771)

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. A denial of service vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to cause the program to crash...

Denial of Service Vulnerability in Weilian Technologies WiSCADA (CNVD-2021-21780)

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. A denial of service vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to cause the program to crash...

Denial of Service Vulnerability in Weilian Technologies WiSCADA

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. A denial of service vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to cause the program to crash...

Denial of Service Vulnerability in Weilian Technologies WiSCADA (CNVD-2021-21770)

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. A denial of service vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to cause the program to crash...

CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

Weak Password Vulnerability in Various Wireless Controllers from Maple Telecom Technologies, Inc.

Founded in 1993, Mapletree Technology Co., Ltd. is a leading supplier of network products and solutions in China, and one of the four major domestic network equipment vendors supported by the Ministry of Industry and Information Technology MIIT. A weak password vulnerability exists in a number of...

Weak Password Vulnerability in Multiple Series of Routers at Xinhua San Technologies Co.

Ltd. was founded on September 26, 2003 . Legal representative Yu Yingtao, the company's scope of business includes: technology development, technical services, technical consulting, results transfer, production, sales: electronic products, software, data communications equipment, broadband access...

Denial of Service Vulnerability in Sensient Technologies Switch GW-9000-7548G

First established in 2013, Shenzhen Beijing Sense & Wink Technology Co. A denial of service vulnerability exists in GW-9000-7548G, which can be exploited by attackers to cause the device to crash...

CVE-2020-35700

creationtimestamp| type| source ---|---|--- 2021-02-13 20:36:37+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2696 2024-10-09 19:13:53+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2677...

CVE-2020-2036

creationtimestamp| type| source ---|---|--- 2021-02-12 12:57:54+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2687...

CVE-2021-26539

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

CVE-2021-26540

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...