‼ CVE-2021-43338 ‼
📖 Read
via "National Vulnerability Database".
In Ericsson Network Location MPS GMPC21, it is possible to creates a new admin user with a SQL Query for file_name in the export functionality.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38420 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38422 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41562 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38407 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38416 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28416 ‼
📖 Read
via "National Vulnerability Database".
HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38488 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38403 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41492 ‼
📖 Read
via "National Vulnerability Database".
Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering. (2) id parameter in manage_products and the (3) t paramater in actions.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42772 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43339 ‼
📖 Read
via "National Vulnerability Database".
In Ericsson Network Location MPS GMPC21, it is possible to inject commands via file_name in the export functionality.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43032 ‼
📖 Read
via "National Vulnerability Database".
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33800 ‼
📖 Read
via "National Vulnerability Database".
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6931 ‼
📖 Read
via "National Vulnerability Database".
HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35053 ‼
📖 Read
via "National Vulnerability Database".
Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38418 ‼
📖 Read
via "National Vulnerability Database".
Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38424 ‼
📖 Read
via "National Vulnerability Database".
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.📖 Read
via "National Vulnerability Database".
📢 “Trojan Source” hides flaws in source code from humans 📢
📖 Read
via "ITPro".
Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks📖 Read
via "ITPro".
IT PRO
“Trojan Source” hides flaws in source code from humans | IT PRO
Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks
📢 Office 365 phishing campaign used stolen Kaspersky Amazon SES token to fool victims 📢
📖 Read
via "ITPro".
Credentials stolen from users after legitimate-looking email arrives in inboxes📖 Read
via "ITPro".
IT PRO
Office 365 phishing campaign used stolen Kaspersky Amazon SES token to fool victims | IT PRO
Credentials stolen from users after legitimate-looking email arrives in inboxes
📢 Microsoft unveils Defender for Business at Ignite 2021 📢
📖 Read
via "ITPro".
The new security suite is aimed at SMBs struggling to protect themselves in today's cyber security landscape📖 Read
via "ITPro".
ITPro
Microsoft unveils Defender for Business at Ignite 2021
The new security suite is aimed at SMBs struggling to protect themselves in today's cyber security landscape