CVE-2021-26625

tobesoft Nexacro arbitrary file download vulnerability

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Tobesoft

Products

Windows Nexacro

CVE-2021-26624

eScan Anti-Virus Local privilege escalation Vulnerability

An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers to exploit root privileges by manipulating parameter values.

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed

Vendors

Escanav

Products

Escan Anti-virus

CVE-2021-26623

Bandisoft ARK Library Out-of-bound Vulnerability

A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Bandisoft Microsoft

Products

Bandizip Windows

CVE-2021-26622

Genian NAC remote code execution vulnerability

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

CVSS 3.1 · 9.6 Critical EPSS 3.0% KEV · Not listed

Vendors

Genians Microsoft

Products

Genian Nac Windows

CVE-2021-26621

Netis Korea MEX01 Buffer overflow vulnerability

An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Netu

Products

Mex01 Mex01 Firmware

CVE-2021-26620

IPTIME NAS2dual improper authentication vulnerability

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Iptime

Products

Nas-i Nas-i Firmware Nas-ii and 15 more

CVE-2021-26619

BigFileAgent arbitrary file Deleting vulnerability

An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bigfile Microsoft

Products

Bigfileagent Windows

CVE-2021-26618

Tmax ToOffice arbitrary file creation vulnerability

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Tmax

Products

Windows Tooffice

CVE-2021-26617

Gabia Firstmall remote code execution vulnerability

This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Firstmall Microsoft

Products

Firstmall Windows

CVE-2021-26616

SecuwaySSL OS command injection vulnerability

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Secuwiz

Products

Secuwayssl U

CVE-2021-26615

bandisoft ARK library integer overflow vulnerability

ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Bandisoft Linux

Products

Ark Library Linux Kernel

CVE-2021-26614

IpTime C200 IP camera remote code execution vulnerability

ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Iptime

Products

C200 C200 Firmware

CVE-2021-26613

tobesoft nexacro arbitrary file creation vulnerability

improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Tobesoft

Products

Windows Nexacro

CVE-2021-26612

tobesoft Nexacro platform arbitrary file creation vulnerability

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft Tobesoft

Products

Windows Nexacro

CVE-2021-26611

HejHome IP Camera use of hard-coded credentials vulnerability

HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Hej

Products

Hejhome Gkw-ic052 Hejhome Gkw-ic052 Firmware

CVE-2021-26610

godomall5 remote code execution vulnerability

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Nhn-commerce

Products

Windows Godomall5

CVE-2021-26609

WordPress Mangboard SQL-Injection vulnerability

A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Mangboard

Products

Mang Board

CVE-2021-26608

handysoft groupware arbitrary file download and execution vulnerability

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Handysoft Microsoft

Products

Hshell Windows

CVE-2021-26607

TOBESOFT NEXACRO17 arbitrary command execution vulnerability

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed

Vendors

Microsoft Tobesoft

Products

Windows Nexacro

CVE-2021-26606

DreamSecurity MagicLine Buffer Overflow Vulnerability

A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP request an affected program. A successful exploit could allow the attacker to remotely execute arbitrary code on a target system.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed

Vendors

Dreamsecurity Microsoft

Products

Magicline4nx.exe Windows