‼ CVE-2021-21883 ‼
📖 Read
via "National Vulnerability Database".
An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40393 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21895 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21912 ‼
📖 Read
via "National Vulnerability Database".
A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21879 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21875 ‼
📖 Read
via "National Vulnerability Database".
A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21907 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted command line argument can lead to local file inclusion. An attacker can provide malicious input to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43853 ‼
📖 Read
via "National Vulnerability Database".
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20601 ‼
📖 Read
via "National Vulnerability Database".
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20425 ‼
📖 Read
via "National Vulnerability Database".
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20598 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20593 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20605 ‼
📖 Read
via "National Vulnerability Database".
Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20426 ‼
📖 Read
via "National Vulnerability Database".
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20600 ‼
📖 Read
via "National Vulnerability Database".
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20595 ‼
📖 Read
via "National Vulnerability Database".
A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20597 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44548 ‼
📖 Read
via "National Vulnerability Database".
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45463 ‼
📖 Read
via "National Vulnerability Database".
GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4144 ‼
📖 Read
via "National Vulnerability Database".
TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.📖 Read
via "National Vulnerability Database".
👍1
🗓️ US clothing supplier Pro Wrestling Tees hit by data breach 🗓️
📖 Read
via "The Daily Swig".
Law enforcement alerted company to compromise of payment card info📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US clothing supplier Pro Wrestling Tees hit by data breach
Law enforcement alerted company to compromise of payment card info