Metasploit Wrap-Up

FortiOS Path Traversal Returning community contributor mekhalleh submitted a module targeting a path traversal vulnerability within the SSL VPN web portal in multiple versions of FortiOS. The flaw is leveraged to read the usernames and passwords of currently logged in users which are stored in...

Denial of Service Vulnerability in Fandango App

Fanduo app is a domestic real estate transaction service platform. There is a denial of service vulnerability in Fanduo app, which can be exploited by attackers to cause a denial of service...

JPress has a flawed logic vulnerability

JPress is a product developed using Java, similar to WordPress. JPress has a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information...

IBM Engineering Requirements Quality Assistant Cross-Site Scripting Vulnerability (CNVD-2021-14752)

IBM Engineering Requirements Quality Assistant is a Watson AI based software from IBM USA used to assist developers in improving the quality of engineering requirements. A cross-site scripting vulnerability exists in IBM Engineering Requirements Quality Assistant. An attacker can exploit the...

Wuhan Douyu Fish Music Network Technology Co., Ltd Douyu Live Companion suffers from dll hijacking vulnerability (CNVD-2021-21511)

Douyu Live Companion is a live streaming software specially developed for the anchors of Douyu. Wuhan Douyu Fish Music Network Technology Co. Douyu Live Companion has a dll hijacking vulnerability, which can be exploited by attackers to execute malicious code and obtain server privileges...

Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-14770)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...

Dell EMC SourceOne Cross-Site Scripting Vulnerability

Dell EMC SourceOne is a powerful archiving solution for handling email, documents and data from disparate collaboration and messaging systems. A stored cross-site scripting vulnerability exists in Dell EMC SourceOne 7.2SP10 and earlier versions. A remote, low-privilege attacker could exploit this...

Information Disclosure Vulnerability in Omnicom's NATouch Touchscreen Configuration Software

hereinafter referred to as "Aotuo Technology", the company's independent intellectual property rights of the products covering programmable controllers, human-machine interfaces, configuration software and so on. An information leakage vulnerability exists in the NATouch touchscreen configuration...

Memory corruption vulnerability exists in Nitro Pro (CNVD-2021-21842)

Nitro pro is a PDF production and management software. A memory corruption vulnerability exists in Nitro Pro. An attacker could exploit this vulnerability to cause the program to crash...

Weilian Technology WiSCADA suffers from information leakage vulnerability

WiSCADA industrial configuration software is a 3D industrial configuration software product that supports Windows, Android and IOS cross-platform. An information disclosure vulnerability exists in Weilian Technology WiSCADA. An attacker can exploit the vulnerability to obtain sensitive informatio...

Beijing Tong APP suffers from unauthorized access vulnerability (CNVD-2021-21759)

Beijing Tong APP is a convenient service software for Beijing citizens. An unauthorized access vulnerability exists in Beijing Tong APP. An attacker can exploit this vulnerability to gain unauthorized access to user information...

Memory corruption vulnerability exists in Nitro Pro (CNVD-2021-21843)

Nitro pro is a PDF production and management software. A memory corruption vulnerability exists in Nitro Pro. An attacker could exploit this vulnerability to cause the program to crash...

Omni-channel customer service system of Foshan Beame Information Technology Co., Ltd. suffers from arbitrary file reading vulnerability

Foshan Beamy Information Technology Co., Ltd. is an Internet software company. There is an arbitrary file reading vulnerability in the omni-channel customer service system of Foshan Bemis Information Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information...

Atlassian Jira Information Disclosure Vulnerability (CNVD-2021-13207)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in Atlassian Jira Server and Data Center, which arises from errors such as...

Atlassian Jira Information Disclosure Vulnerability (CNVD-2021-13208)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in Atlassian Jira Server and Data Center, which arises from errors such as...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 cross-site scripting vulnerability (CNVD-2021-17235)

Mb Connect Line MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE Mb Connect Line, Germany. A cross-site scripting vulnerability exists in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24, which arises from the failure of a network...

BIG-IP cross-site scripting vulnerability (CNVD-2021-13214)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in BIG-IP, which stems from the lack of proper validation of client-side data by t...

Buffer Overflow Vulnerability in EasyBuilder Pro

EasyBuilder Pro is a configuration software developed by Wyland. A buffer overflow vulnerability exists in EasyBuilder Pro. An attacker can exploit this vulnerability to cause the program to crash...

Owncloud Cross-Site Request Forgery Vulnerability

Owncloud ownCloud is a set of personal cloud storage solutions from the American company ownCloud Owncloud. A cross-site request forgery vulnerability exists in OwnCloud Core, which stems from a WEB application that does not adequately validate whether a request is coming from a trusted user, and...

SQL Injection Vulnerability in the Home Furnishing ERP Management System of Shanghai Furnishing Alliance Information Technology Co.

Ltd. is a software service company specializing in enterprise management solutions for the decoration industry. There is a SQL injection vulnerability in the Home Decoration ERP Management System of Shanghai Decoration Alliance Information Technology Co., Ltd, which can be exploited by attackers ...