SQL Injection Vulnerability in Cloud Research's Employment Platform

Changsha Yunyan Network Technology Co., Ltd. is an Internet company. A SQL injection vulnerability exists in Cloud Research's employment platform. An attacker can utilize the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PV Power Plant Monitoring System of Jiangsu Goodway Power Technology Co.

Jiangsu Goodway Power Supply Technology Co., Ltd. is a new energy high-tech enterprise. A SQL injection vulnerability exists in the monitoring system of the photovoltaic power plant of Jiangsu Goodway Power Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information fr...

Unauthorized Access Vulnerability in Video Fusion Gateway of Jiangsu Huaiye Information Technology Co.

Jiangsu Huaiye Huaiye is an original manufacturer with two independent core technologies of video cloud switching and wireless broadband private network communication. An unauthorized access vulnerability exists in the Video Convergence Gateway of Jiangsu Huaiye Information Technology Company...

Silicon Peak website builder system suffers from SQL injection vulnerability

Shaanxi Silicon Peak Network Technology Co., Ltd. is a high-end brand network company integrating "website design, software development, micro letter construction" and other informationization services. There is a SQL injection vulnerability in Silicon Peak's website builder system, which can be...

GitHub Updates Policy to Remove Exploit Code When Used in Active Attacks

Code-hosting platform GitHub Friday officially announced a series of updates to the site's policies that delve into how the company deals with malware and exploit code uploaded to its service. "We explicitly permit dual-use security technologies and content related to research into vulnerabilitie...

Zhejiang WoSmith Information Technology Co., Ltd. WoSmith list store mall system file contains vulnerabilities

Zhejiang WoSmith Information Technology Co., Ltd. is a technology company specializing in mobile Internet technology development. Zhejiang WoSmith Information Technology Co., Ltd. WoSmith list store mall system file contains a vulnerability that can be exploited to obtain server privileges...

SQL Injection Vulnerability in the Traffic Security Management of Tianrongxin Technology Group

Founded on August 30, 1985, Skyrise Technology Group, or "Skyrise" for short, is a leading provider of network security, big data and security cloud services in China. A SQL injection vulnerability exists in the traffic security management of Tianrongxin Technology Group. An attacker can exploit...

Guangzhou Redfan Technology Co., Ltd. ioffice has unauthorized access vulnerability

hereinafter referred to as: Redfan Technology is a high-tech enterprise held by Guangzhou Shipbuilding International Company Limited, a subsidiary of China State Shipbuilding Corporation CSSC, one of the top ten military industrial groups. Guangzhou Redsail Technology Co. ioffice has an...

CVE-2021-31249

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components...

CVE-2021-31250

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi...

Open redirect

An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it...

CVE-2021-31250

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi...

Crlf injection

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components...

CVE-2021-31252

An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it...

Cross site scripting

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi...

CVE-2021-31249

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components...

CVE-2021-31249

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450M devices are affected by CVE-2021-31249, a CRLF injection flaw stemming from insufficient validation of the redirect= parameter in multiple CGI components. Exploitation could lead to information disclosure, data modification, or unauthorized admin...

CVE-2021-31250

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi...

CVE-2021-31250

CHIYU TCP/IP Converter devices BF-430, BF-431 and BF-450M are affected by CVE-2021-31250 (XSS) due to insufficient input sanitization in several web components (man.cgi, if.cgi, dhcpc.cgi, ppp.cgi). Exploitation could allow a attacker to execute arbitrary JavaScript in a victim’s browser, with po...

CVE-2021-31251

CVE-2021-31251 affects CHIYU IoT devices (BF-430, BF-431, BF-450M, SEMAC). The issue is an authentication bypass in the device telnet server, caused by a malformed telnet negotiation request that can cause the remote telnet server to treat the attacker as already authenticated, allowing a privile...