CVE-2022-25130

CVE-2022-25130 describes a command-injection vulnerability in the TOTOLINK routers’ updateWifiInfo function. Affects T6 V3 firmware 4.1.5cu.748_B20211015 and T10 V2 firmware V4.1.8cu.5207_B20210320. An attacker can achieve arbitrary command execution by sending a crafted MQTT packet, without auth...

CVE-2021-46597

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-21727)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Command Execution Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A command execution vulnerability exists in BossCMS, which can be exploited to gain server privileges...

Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huanxin Information Technology Company Limited (CNVD-2022-21723)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. BossCMS has an arbitrary file deletion vulnerability, which can be exploited to delete any file on the server...

Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huanxin Information Technology Company Limited (CNVD-2022-21724)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. BossCMS has an arbitrary file deletion vulnerability, which can be exploited to delete any file on the server...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-21725)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/

Description The Introduction of a New Line Character lets the attacker the stack trace at demo.microweber.org/ This Attack becomes more significant because of its Less complication. The Stack trace discloses following information : 1. Backend Response code. 2. The Versions of Backend Laravel...

TrickBot Malware Targeted Customers of 60 High-Profile Companies Since 2020

The notorious TrickBot malware is targeting customers of 60 financial and technology companies, including cryptocurrency firms, primarily located in the U.S., even as its operators have updated the botnet with new anti-analysis features. "TrickBot is a sophisticated and versatile malware with mor...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Keking kkFileview 路径遍历漏洞

Keking KkFileview is a Spring-Boot project from Keking Technology Keking, a Chinese company that builds online previews for documents. A security vulnerability exists in Keking KkFileview, which originates from the presence of a directory traversal vulnerability to read arbitrary files, which cou...

Vulnerabilities fixed in Intel Wi-Fi chipset firmware

Intel has fixed several vulnerabilities in various Intel PROSet/Wireless Wi-Fi and Intel Active Management Technology AMT Wireless chipsets. The vulnerabilities allow a local malicious party to carry out attacks that result in the following categories of damage: Denial-of-Service DoS. Access to...

Command Execution Vulnerability in Sunflower Personal Edition for Windows at Shanghai Berry Information Technology Co.

Sunflower is a free, all-in-one remote control management tool software that integrates remote control of computer and cell phone, remote desktop connection, remote boot, remote management, and intranet penetration support. Ltd. Sunflower Personal Edition for Windows has a command execution...

Unauthorized Access Vulnerability in KingPortal Development System of Beijing Acontrol Technology Development Co.

Ltd. is an automation software platform high-tech enterprise. Ltd. KingPortal development system has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information...

File Upload Vulnerability in Agricultural Water Pricing Reform System of Siltronic Ltd.

Siltronic is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. A file upload vulnerability exists in the Agricultural Water Pricing Reform System of Siltronic Technology Limited, which can be exploited by attackers to gain control of the server...

Arbitrary File Deletion Vulnerability in Agricultural Water Pricing Reform System of Siltronic Ltd.

Siltronic Ltd. is a technology-based enterprise dedicated to the cause of disaster prevention and mitigation in China. An arbitrary file deletion vulnerability exists in the Agricultural Water Pricing Reform System of Siltronic Technology Limited, which can be exploited by attackers to compromise...

Unauthorized Access Vulnerability in KingFusion Development System of Beijing Asian Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of automation software platform. Beijing Asia Control Technology Development Co., Ltd. KingFusion development system there is an unauthorized access vulnerability, attackers can use the vulnerability to obtain...

The Forecast Is Flipped: How Rapid7 Is Flipping L&D for the Future of Work

The last 2 years have turned the world on its head, and now, companies across the globe are transitioning into a new normal. In this hybrid world, employee engagement is a moving target, the market is more competitive, and historical face-to-face teaching practices are no longer viable. Rapid7’s...

CVE-2022-24289 Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence ROP feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and...

Kazoo Server 授权问题漏洞

Qnap Kazoo Server is a server from China's Weilian Technology Qnap. An authorization issue vulnerability exists in Kazoo Server because Qnap Nas running on the product does not validate the user's identity. The vulnerability can be exploited by an attacker to compromise the security of the system...