CVE-2021-36767

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's...

CVE-2021-25470

An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE...

Cisco IP Phone 路径遍历漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. A path traversal vulnerability exists in Cisco IP Phone that stems from insufficient input validation. An attacker can exploit this vulnerability by providing crafted input to...

Backdoor.Win32.Prorat.lkt Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/dec8f9042986d64e29d62effb482290b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.lkt Vulnerability: Weak Hardcoded Password Description: The ProSpy Server V1.9...

SOGo Authentication Signature

The vulnerability of the SOGo collaborative computing software’s authentication method is related to improper verification of the data’s cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Bosch Rexroth IndraMotion MLC 访问控制错误漏洞

The Bosch Rexroth IndraMotion Mlc is a new device that combines motion and logic control, as well as robot control. A security vulnerability exists in Bosch Rexroth IndraMotion Mlc, which arises from a networked system or product that does not properly use the relevant cryptographic algorithms, a...

CVE-2021-39874: Undefined Security Weakness

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...

CVE-2021-20578

IBM Cloud Pak for Security CP4S 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282...

IBM Cloud Pak for Security 加密问题漏洞

IBM Cloud Pak for Security CP4S is an open security platform from IBM that connects to your existing data sources, generates deeper insights, and enables you to act faster with automation. IBM Cloud Pak for Security CP4S suffers from an encryption issue vulnerability in versions 1.7.0.0, 1.7.1.0,...

Dell VNX2 Authentication Bypass

The vulnerability of the Dell VNX2 storage system is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Apple AirTag Bug Enables ‘Good Samaritan’ Attack

The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owners phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused t...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. Nagios XI has a security vulnerability that stems from a lack of authentication measures or insufficient...

CVE-2021-36366: Undefined Security Weakness

Nagios XI before 5.8.5 incorrectly allows manageservices.sh wildcards...

ZOOM Zoom Client 信任管理问题漏洞

ZOOM Zoom Client is a video conferencing client application from Zoom ZOOM USA that supports multiple platforms. A security vulnerability exists in Zoom Client that arises from a lack of authentication measures or insufficient authentication strength in a networked system or product...

CVE-2021-41558: Undefined Security Weakness

The setuser extension module before 3.0.0 for PostgreSQL allows ProcessUtilityhook bypass via setconfig...

CVE-2021-40329: Undefined Security Weakness

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management...

CVE-2021-23243: Undefined Security Weakness

In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used...

D-link Dcs-932L和D-link Dcs-5000L 授权问题漏洞

D-link Dcs-5000L is an Ip network surveillance camera. d-link Dcs-932L is a network surveillance camera. a security vulnerability exists in the D-Link DCS-5000L and DCS-932L, which stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

Security Weakness Resulting in Potential Local Privilege Escalation When HA (High Availability) is Active

A weakness in the SMA100 Series exists when High Availability HA pair is active, potentially permitting an operation at a privilege's level that is higher than the minimum level required. If a malicious actor obtains a 'nobody' user shell on an impacted SMA100 device, this can potentially lead to...

PHP 路径遍历漏洞

PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP that arises from a lack of effective privilege-granting and access-control measures in a networked system or product...