CVE-2024-6406

The CVE concerns Yordam Information Technology Mobile Library Application prior to version 5.0, where a Missing Authentication for a Critical Function and Missing Authorization flaw allows retrieval of embedded sensitive data. Root cause is insufficient access control on a critical function withi...

CVE-2024-6406 Sensetive Data Exposure in Yordam Information Technology's Mobile Library Application

Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data. This issue affects Mobile Library Application: before 5.0...

Weak Password Vulnerability in Next-Generation Firewall SG-6000 of Shanshi Netcom Technology (Beijing) Co.

Ltd. is a company specializing in technological innovation in the field of network security. A weak password vulnerability exists in the SG-6000 next-generation firewall of Shanshi Netcom Technology Beijing Co. Ltd, which can be exploited by attackers to obtain sensitive information...

CVE-2024-6406: Missing Authentication for Critical Function

Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data. This issue affects Mobile Library Application: before 5.0...

U.S. Treasury Sanctions Executives Linked to Intellexa Predator Spyware Operation

The U.S. Department of Treasury has imposed fresh sanctions against five executives and one entity with ties to the Intellexa Consortium for their role in the development, operation, and distribution of a commercial spyware called Predator. "The United States will not tolerate the reckless...

Command Execution Vulnerability in FW Next Generation Firewall of Shanghai Bingfeng Computer Network Technology Co.

Shanghai Bingfeng Computer Network Technology Co., Ltd. specializes in the research and development and sales of VPN, firewall, Internet behavior management and other network security products, and is committed to providing China's network communication operators and enterprises and institutions...

SQL Injection Vulnerability in Integrated Academic Affairs Management System of Hunan Qiangzhi Technology Development Co. Ltd (CNVD-2024-41212)

Hunan Qiangzhi Technology Development Co., Ltd. is an education informatization service provider. A SQL injection vulnerability exists in the Integrated Academic Affairs Management System IAMS of Hunan Qiangzhi Technology Development Company Limited, which can be exploited by attackers to obtain...

SQL Injection Vulnerability in anysec Second Generation Firewall System of Shenzhen Zhongke NetWizard Technology Co.

Ltd. is a high-tech enterprise focusing on the research, development and production of network security products. Shenzhen Zhongke NetWizard Technology Co., Ltdanysec second generation firewall system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring.

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVEs: CVE-2024-21147, CVE-2024-21145, CVE-2024-21140, CVE-2024-21144, CVE-2024-21138, CVE-2024-21131 and CVE-2024-27267 Vulnerability Details CVEID:CVE-2024-21147...

Siemens SIMATIC RFID Readers Mishandling Vulnerability

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

SQL Injection Vulnerability in Intelligent Park Integrated Management System of Zhejiang Dahua Technology Co.(CNVD-2024-41305)

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A SQL injection vulnerability exists in the integrated management system of the Smart Park of Zhejiang Dahua Technology Co. Ltd, which can be exploited by...

crypto: qat - resolve race condition during AER recovery

...

SQL Injection Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-41582)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...

SQL Injection Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-41583)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...

CosmicBeetle Deploys Custom ScRansom Ransomware, Partnering with RansomHub

The threat actor known as CosmicBeetle has debuted a new custom ransomware strain called ScRansom in attacks targeting small- and medium-sized businesses SMBs in Europe, Asia, Africa, and South America, while also likely working as an affiliate for RansomHub. "CosmicBeetle replaced its previously...

CVE-2024-44667

The Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router (version M7628NNxISPxUIv2_v1.0.1557.15.35_P0 ) is affected by an Incorrect Access Control vulnerability. This flaw allows for unauthenticated factory mode reset and command injection , which can lead to information exposure and ...

CVE-2024-37728

Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface...

CVE-2024-37728

Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface...

GeoServer Vulnerability Targeted by Hackers to Deliver Backdoors and Botnet Malware

A recently disclosed security flaw in OSGeo GeoServer GeoTools has been exploited as part of multiple campaigns to deliver cryptocurrency miners, botnet malware such as Condi and JenX, and a known backdoor called SideWalk. The security vulnerability is a critical remote code execution bug...

CVE-2024-6445

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This issue affects DataDiodeX: from v3.0.0 before v3.1.7...