Common Cloud Misconfigurations Exploited in Minutes, Report

Poorly configured cloud services can be exploit by threat actors in minutes and sometimes in under 30 seconds. Attacks include network intrusion, data theft and ransomware infections, researchers have found. Researchers at Palo Alto Networks’ Unit 42 used a honeypot infrastructure of 320 nodes...

CVE-2021-40333

Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network DCN routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A...

Security Bulletin: Weak Cryptographic Control Vulnerability Affects IBM Sterling Connect:Direct Web Services (CVE-2021-38891)

Summary IBM Sterling Connect:Direct Web Services used weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-38891 DESCRIPTION: IBM Sterling Connect:Direct Web...

The vulnerability of the microprogrammed logical controller ioLogik software, related to insufficient requirements for password complexity, allows a hacker to gain access to the user account.

The vulnerability of the microprogrammed logic controller ioLogik software is related to insufficient requirements for the complexity of passwords. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the user account...

The vulnerability of the microprogrammed logic controller ioLogik software, related to insufficient requirements for password complexity, allows a hacker to obtain user passwords by brute-force methods.

The vulnerability of the microprogrammed logic controller ioLogik software is related to insufficient requirements for the complexity of passwords. Exploiting this vulnerability allows a malicious actor to manually select user passwords using brute-force methods...

CVE-2021-38891

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508...

IBM Sterling Connect:Direct 加密问题漏洞

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from IBM in the United States. A security vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from the use of weaker-than-expected encryption algorithms that could allow an attacker to decrypt...

NVIDIA GPU 安全漏洞

Nvidia Gpu is a graphics processing unit from the American company Nvidia. It is used in machine learning, video editing, and gaming applications. A security vulnerability exists in NVIDIA GPUs and Tegra hardware that stems from a user with elevated privileges using a debugging mechanism with...

in star7th/showdoc

Description Logged in by LDAP will lead to a weak-password initialization， php isExist$username ; if!$userInfo D"User"-register$ldapuser,$ldapuser.time; //【register with a weak password, such as : tom/tom1637248826】 $rs2=ldapbind$ldapconn, $dn , $password;//【when the LDAP password is WRONG，no...

The vulnerability of the implementation of the Advanced Encryption Standard (AES) encryption algorithm in software for remote control of computers via TeamViewer allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the AES encryption algorithm implemented in software for remote control of computers via TeamViewer is related to weak password requirements. Exploiting this vulnerability could allow a hacker to circumvent security restrictions and gain unauthorized access to protected...

DRUPAL-CONTRIB-2021-044

This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This...

java security update

CentOS Errata and Security Advisory CESA-2021:3889 An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

Information disclosure

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

Pterodactyl 跨站请求伪造漏洞

Pterodactyl is an open source game server management panel built using PHP, Nodejs and Go. A cross-site request forgery vulnerability exists in Pterodactyl, which stems from the lack of proper CSRF protection in the product's routing configuration. An attacker could exploit the vulnerability to...

Spree 跨站请求伪造漏洞

Spree is an open source mall developed using Ruby on Rails by an individual developer. A cross-site request forgery vulnerability exists in Spree auth devise, which stems from a lack of effective validation of the product's authentication against CSRF. This vulnerability can be exploited to send...

Unspecified Vulnerability in IBM Tivoli Key Lifecycle Manager

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IBM Tivoli Key Lifecycle Manager that stems fr...

Weak password vulnerability in Huawei USG2210E

The USG2210E Security Gateway is a new generation firewall/UTM appliance designed for small and medium-sized businesses/branch offices. A weak password vulnerability exists in Huawei USG2210E, which can be exploited by attackers to obtain sensitive information...