‼ CVE-2021-1522 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22124 ‼
📖 Read
via "National Vulnerability Database".
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38111 ‼
📖 Read
via "National Vulnerability Database".
The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic Induction) protocol.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32464 ‼
📖 Read
via "National Vulnerability Database".
An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services could allow an attacker to modify a specific script before it is executed. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32793 ‼
📖 Read
via "National Vulnerability Database".
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26096 ‼
📖 Read
via "National Vulnerability Database".
Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1609 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of the Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an attacker to do the following: Execute arbitrary code Cause a denial of service (DoS) condition Execute arbitrary commands For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38113 ‼
📖 Read
via "National Vulnerability Database".
In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e., bouqueteditor/api/addbouquet?name=) leads to Stored XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1572 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. To exploit this vulnerability, an attacker must have a valid account on an affected device. The vulnerability exists because the affected software incorrectly runs the SFTP user service at the privilege level of the account that was running when the ConfD built-in Secure Shell (SSH) server for CLI was enabled. If the ConfD built-in SSH server was not enabled, the device is not affected by this vulnerability. An attacker with low-level privileges could exploit this vulnerability by authenticating to an affected device and issuing a series of commands at the SFTP interface. A successful exploit could allow the attacker to elevate privileges to the level of the account under which ConfD is running, which is commonly root. Note: Any user who can authenticate to the built-in SSH server may exploit this vulnerability. By default, all ConfD users have this access if the server is enabled. Software updates that address this vulnerability have been released.📖 Read
via "National Vulnerability Database".
❌ Black Hat: Security Bugs Allow Takeover of Capsule Hotel Rooms ❌
📖 Read
via "Threat Post".
A researcher was able to remotely control the lights, bed and ventilation in "smart" hotel rooms via Nasnos vulnerabilities.📖 Read
via "Threat Post".
Threat Post
Black Hat: Security Bugs Allow Takeover of Capsule Hotel Rooms
A researcher was able to remotely control the lights, bed and ventilation in "smart" hotel rooms via Nasnos vulnerabilities.
❌ ‘I’m Calling About Your Car Warranty’, aka PII Hijinx ❌
📖 Read
via "Threat Post".
Black Hat: Researchers created 300 fake identities, signed them up on 185 legit sites, then tracked how much the sites used signup PII to pester the accounts.📖 Read
via "Threat Post".
Threat Post
‘I’m Calling About Your Car Warranty’, aka PII Hijinx
Black Hat: Researchers created 300 fake identities, signed them up on 185 legit sites, then tracked how much the sites used signup PII to pester the accounts.
‼ CVE-2020-22352 ‼
📖 Read
via "National Vulnerability Database".
The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38114 ‼
📖 Read
via "National Vulnerability Database".
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38115 ‼
📖 Read
via "National Vulnerability Database".
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24829 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3539 ‼
📖 Read
via "National Vulnerability Database".
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36800 ‼
📖 Read
via "National Vulnerability Database".
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36803 ‼
📖 Read
via "National Vulnerability Database".
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36801 ‼
📖 Read
via "National Vulnerability Database".
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31867 ‼
📖 Read
via "National Vulnerability Database".
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36802 ‼
📖 Read
via "National Vulnerability Database".
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product.📖 Read
via "National Vulnerability Database".