CVE-2020-36127

PAX Technology PAXSTORE v7.0.8_20200511171508 and earlier are affected by an information disclosure vulnerability. The issue arises via the PUK signature functionality, where an administrator cannot view the current p12 certificate password, and when replacing the certificate the new p12 is retur...

CVE-2020-36128

CVE-2020-36128 affects Pax Technology PAXSTORE v7.0.8_20200511171508 and earlier. The vulnerability stems from token impersonation: each terminal uses an X-Terminal-Token to access the marketplace, and an attacker can intercept HTTPS requests to obtain the token assignment and craft a token to im...

CVE-2020-36128

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token called X-Terminal-Token to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its...

CVE-2021-30173 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File Inclusion

Local File Inclusion vulnerability of the omni-directional communication system allows remote authenticated attacker inject absolute path into Url parameter and access arbitrary file...

CVE-2021-30172 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30170 Jun-He Technology Ltd. ERP POS - Stored XSS-1

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Pax Technology PAXSTORE 安全漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An information disclosure vulnerability exists in Pax Technology PAXSTORE version v7.0.8202005111715...

Weak Password Vulnerability in Aifei Flow Control Routing of AllConvergence Network Technology (Beijing) Co.

Quanxun Convergence Network Technology Beijing Co., Ltd. was founded in 2013, love fast, iKuai is the company's product brand, iKuic is the company's overseas product brand. A weak password vulnerability exists in iKuai flow control routing, which can be exploited by attackers to obtain sensitive...

Weak Password Vulnerability in 3G/4G Router of Shenzhen Hongdian Technology Co.

3G/4G Router is a router device of Shenzhen Hongdian Technology Co. A weak password vulnerability exists in the Shenzhen Hongdian Technology Co. 3G/4G Router, which can be exploited by attackers to obtain sensitive information...

竣禾科技全方位通讯系统安全漏洞

Junghee Technology Omni-Communication System is an application software of China Junghee Technology Co. The system is used for communication gateway. A security vulnerability exists in Junghua Technology Total Communication System, which can be exploited by attackers to inject absolute paths into...

PAX Technology PAXSTORE 授权问题漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An access control error vulnerability exists in Pax Technology PAXSTORE version v7.0.820200511171508...

竣禾科技全方位通讯系统跨站脚本漏洞

Junghee Technology Omni-Communication System is an application software of China Junghee Technology Co. It is used for communication gateway system. A cross-site scripting vulnerability exists in the Junghua Technology Omni-Communication System, which originates from the special characters on the...

Command Execution Vulnerability in Octopus Technology Limited's Code Up App

Code on the line is a service app for subway travel. A command execution vulnerability exists in the Code Up APP of Octopus Technology Limited, which can be exploited by an attacker to gain control of the server...

Command Execution Vulnerability in Multimedia Dispatch System of Beijing Jieshirui Technology Co.

Ltd. is a high-tech enterprise founded by overseas returned high-tech talents. A command execution vulnerability exists in the multimedia scheduling system of Beijing Jieshirui Technology Co., Ltd, which can be exploited by attackers to execute arbitrary commands...

Pax Technology PAXSTORE 安全漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million endpoints, thousands of application developers and more than 180 marketplaces in more than 80 countries/regions around the world. A security vulnerability exists in Pax Technology PAXSTORE...

Arbitrary File Download Vulnerability in Dahua In-vehicle Comprehensive Management Platform of Zhejiang Dahua Technology Company Limited (CNVD-2021-35888)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file download vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability ...

Command Execution Vulnerability in Skyrun TopVPN 6000

Skyrise Technology Group Skyrise is a provider of network security, big data and security cloud services. A command execution vulnerability exists in Tianrongxin TopVPN6000. An attacker can exploit this vulnerability to gain control of the server...

SQL Injection Vulnerability in Cross-border E-commerce Order System of Hualei Information Technology Co.

Founded in 2013, Hualei Information Technology Co., Ltd. is a professional information technology service provider. A SQL injection vulnerability exists in the cross-border e-commerce order system of Hualei Information Technology Co. An attacker can exploit the vulnerability to obtain sensitive...

Arbitrary File Download Vulnerability in Dahua In-vehicle Comprehensive Management Platform of Zhejiang Dahua Technology Company Limited (CNVD-2021-35881)

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file download vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability ...

File Upload Vulnerability in Dahua In-vehicle Integrated Management Platform of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. A file upload vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability to upload a...