The Curious Engineer

All blogs / Security

SEC Consult

sec-consult.com

SEC Consult is one of the leading consultancies in the field of cyber and application security. The company specializes in information security management, security audits, penetration testing, ISO 27001 certification support, cyber defense and secure software certification.

Security

’05’10’15’20’25
Posts
654 from 20 Jan 2003 to 23 Oct 2026
Posting
monthly (6 in the last year)
Kind
company blog
Also at
https://sec-consult.com/blog

2026 6

  1. Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
  2. Multiple critical vulnerabilities in multiple TP-Link device series
  3. From: [email protected] - Spoofing Arbitrary Apple iCloud Identities
  4. Multiple Vulnerabilities in Paessler PRTG Network Monitor
  5. Navigating the ethical boundaries of independent security research: A comprehensive analysis of the consumer pet tracking ecosystem
  6. Hands-Free Lockpicking: Critical Vulnerabilities in dormakaba’s Physical Access Control System

2025 11

  1. Forensics gone wrong? Unpredicted behaviour of writeblockers
  2. Visit SEC Consult at it-sa 2025
  3. C2 powered by dinosaurs
  4. Pentesting in a World without Servers
  5. SEC Consult at the ICT Security Conference 2025
  6. Sleeping Beauty: Taming CrowdStrike Falcon With One Simple Trick
  7. How Beyond Gravity, a leading Swiss aerospace company, is fortifying cybersecurity: a real-life success story
  8. Ransomhub Ransomware: Double-Extortion Attack and How to Defend
  9. Join us at the Swiss Cyber Security Days!
  10. A Missed Opportunity: Addressing Weak Password Hashing in VxWorks
  11. Cyber Threats to EV Charging Infrastructure: Risks and Protection through Penetration Testing

2024 18

  1. TLPT in the Financial Sector Under DORA: Assessing the Current Status of TIBER
  2. Inside an Active Intrusion: Exclusive Interview with the Incident Manager
  3. Debunking Cloud Security Myths: Clearing Misconceptions That Risk Your Business
  4. Ransomgroup Helldown: Attacks on Zyxel Devices
  5. Enhancing Network Security: Monitoring Client Communication with Velociraptor
  6. SEC Consult at the ICT Security Conference 2024
  7. Unlocking Cloud Security: Insights from the DORA Framework
  8. Unveiling Qilin/Agenda Ransomware - A Deep Dive into Modern Cyber Threats
  9. Securing the Digital Frontier: Navigating Software Supply Chain Risks with the EU's Cyber Resilience Act
  10. Qualified Body (QuaSte) for Verification of Compliance with the NIS Act
  11. About smugglers, bumblebees and dinosaurs - and how to take over the world
  12. SEC Consult Germany Secures Top Ranking Once More in Great Place To Work® Awards 2024
  13. Cyber resilience: Internet-based vehicle registration (i-Kfz) demands higher security standards from registration authorities
  14. Data Security in Data Protection
  15. Digital operational resilience testing program according to DORA
  16. We are "Best Employer" in Germany and Austria in 2024! SEC Consult once again certified as a "Great Place to Work"®
  17. DORA: One year to go until full compliance with the new regulatory framework
  18. SECGlitcher (Part 1) - Reproducible Voltage Glitching on STM32 Microcontrollers

2023 25

  1. SMTP Smuggling - Spoofing E-Mails Worldwide
  2. TRAP; RESET; POISON; - Taking over a country Kaminsky style
  3. Guardians of the Digital Realm: Celebrating 400 Advisories and Responsible Disclosure
  4. Modern Phone Scammers: Stealing Money with a Phone Call
  5. Android Mobile Root Detection – Snake Oil or Silver Bullet?
  6. Human factor: an underestimated issue in cybersecurity
  7. Thomas Houiellebecq is the new Head of Cyber Security Consulting of SEC Consult (Switzerland) Ltd.
  8. Ransomware: A Growing Digital Threat and How to Defend Against It
  9. Swiss Cyber Storm 2023 – The Human Factor
  10. Escaping Phishermen Nets: Cryptographic Methods Unveiled in the Fight Against Reverse Proxy Attacks
  11. SEC Consult Austria: Amir Salkic is new Head of CyberSecurity Consulting
  12. Nimpostor: Bringing the nim language to Mythic C2
  13. Responsible Disclosure of an Exploit Chain Targeting the RFC Interface Implementation in SAP® Application Server for ABAP
  14. DNS Analyzer - Finding DNS vulnerabilities with Burp Suite
  15. Bypassing Android Biometric Authentication
  16. Alternative Mobile Messengers From An OWASP Point Of View
  17. Securing Databricks cluster init scripts
  18. BumbleBee hunting with a Velociraptor
  19. "Great Place To Work" awards Germany's Best Employers 2023: SEC Consult Germany top-ranked again
  20. Visual Signature Spoofing in PDFs
  21. Blackmail Roulette: The Risks of Electronic Shelf Labels for Retail and Critical Infrastructure
  22. Better don't be too QUIC(K)
  23. SEC Consult is once again one of the top employers in the cybersecurity industry in 2023
  24. Log Management & Digital Forensics in Data Protection
  25. Operational Technology Security (OT) meets Ransomware: An underestimated security risk

2022 13

  1. The hidden costs of parental control apps
  2. The enemy from within: Unauthenticated Buffer Overflows in Zyxel routers still haunting users
  3. The eufyCam Long-Term Observation
  4. Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style
  5. Phishing is booming! Security checklist for the 6 most widespread methods.
  6. Microsoft Exchange Server Zero-Day Exploit
  7. SEC Consult Austria is also one of the best addresses for cybersecurity experts in 2022!
  8. 360 degree cyber security - planned & implemented by the number 1!
  9. Someone call the patch manager
  10. A Primer on Cold Boot Attacks Against Embedded Systems
  11. SEC Consult Germany is also a "Great Place To Work" in 2022 with a top ranking in the ITK category!
  12. The role of top leadership in IT security: RUAG International Success Story
  13. 5GCroCo H2020 EU - Project: Seamless Connected and Automated Mobility in Europe

2021 20

  1. New Services by SEC Defence
  2. Zyxel Communications and SEC Consult reach next-level of cybersecurity
  3. HiKam - "Hi - I'm (not) your Kam"
  4. Forgot password? Taking over user accounts Kaminsky style
  5. Trust is good, certificates are better!
  6. Atos Switzerland completes local acquisition of cybersecurity specialist SEC Consult
  7. Authentication Bypass Vulnerability Affecting All SAP Kernel (ABAP) Releases in Maintenance
  8. SEC Consult Germany awarded as Best Employer in the ITK category
  9. Challenges for SAP® Security and how to approach them
  10. Aggrokatz: pypykatz meets Cobalt Strike
  11. Career Advice for Cybersecurity Newcomers
  12. Who saves the world? Girls!
  13. ISO 27001: What documentation is required for certification?
  14. SAP® Privilege Escalation through ABAP Code Injection in SAP® Business Warehouse
  15. Happy Pi-Day! We got a challenge for you!
  16. Great Place to Work: We are certified!
  17. Top 5 Of The Simplest And Most Effective Measures To Prevent Hacker Attacks
  18. IT Security In The Home Office – What Should Be Considered?
  19. Remotely Exploitable Flaws in SAP® Business Warehouse and SAP® BW/4HANA
  20. From Hackable Garage Doors To Insecure Security Products

2020 25

  1. Atos completes the acquisition of leading Cybersecurity consulting company SEC Consult
  2. Bug Or Feature: Privilege Escalation In Windows Autopilot
  3. Data Breach In The Home Office – And Now?
  4. TIBER-DE: Identify Vulnerabilities In The Cyber Defense Strategy With The Red Teaming Test
  5. Data Security And Compliance In The Home-Office
  6. Hörmann: Opening Doors for everyone...
  7. SEC Consult to join forces with Atos
  8. TIBER-DE: Attack Simulations To Ensure Greater Resilience Against Cyber-Attacks In The Financial Sector
  9. Deanonymization Of Lithuanian E-Signature Users
  10. FIDO2 for Microsoft Online Accounts / Azure AD
  11. Code Injection in SAP Application Server ABAP - Solution Tools Plugin ST-PI
  12. Ad-Hoc Log Management in case of Emergency (SEC Defence)
  13. Security Requirements Engineering - Reaching Mastery
  14. Creating Active Directory Labs for Blue and Red Teams
  15. Security Requirements Engineering – The Backbone Of Your SSDLC
  16. A Deep Dive Into Secure Software Development Based On OWASP SAMM
  17. Patch Immediately: Critical Vulnerability In SAP® ABAP Systems (CVE-2020-6262)
  18. First Virtual OWASP Vienna Chapter Meeting: Secure Software Development With OWASP SAMM
  19. TIBER-DE: SEC Consult Helps The Financial Sector To Strengthen Its Cyber-resilience
  20. Corona Crisis: SEC Consult Is Still There For All Customers
  21. IT Security In Times Of The Coronavirus Is Both Different And Diverse
  22. Corona Virus And Unintentional Cyber Consequences
  23. SEC Consult Goes Bochum: Security Specialist Opens New Office In German “Capital Of IT Security"
  24. The Impact On Security Testing For Devops-driven Applications
  25. How To Use Blockchain Technology To Secure Forensic Evidence

2019 17

  1. Critical Success Factors For Your ISO/IEC 27001 Certification Audit
  2. Winning The Interface War: Extracting Information From Electronic Devices With The SEC Xtractor
  3. The Brand New ÖNORM A 7700 Is Live
  4. Impressions From The NASA Space Apps Challenge Vilnius
  5. Vulnerability In EU Cross-Border Authentication Software (eIDAS Node)
  6. Ready For The NISG & NISV? – Official Requirements For Dealing With Security Incidents
  7. Global Cyberlympics 2019 – SEC Consult Team “no Signal” Is Top 2 Of Asia
  8. Mailvelope: BSI Improves Email Security
  9. SEC Consult Supports Global Standardization And Certification Initiatives
  10. Behind The Scenes: Baltic Cyber Security Forum 2019
  11. Devdays 2019: How To Bypass Web Application Firewalls
  12. Unsung Heroes: What It Really Means To Be Successful In IT Security
  13. Windows Privilege Escalation – An Approach For Penetration Testers
  14. Pentesting: Benefits, Legal Compliance And Costs
  15. Reverse Engineering Architecture And Pinout of Custom Asics
  16. One Hack Of A Valentine: When Iot Gets Under Your Skin
  17. Cryptographic Vulnerabilities In German E-government Library

2018 15

  1. My Name Is Johann Wolfgang Von Goethe – I Can Prove It
  2. Kitten Of Doom – Why You Should Patch Skype For Business Immediately
  3. Millions Of Xiongmai Video Surveillance Devices Can Be Hacked Via Cloud Feature (Xmeye P2p Cloud)
  4. Solution For The Google CTF 2018 Hacking Contest
  5. Application Security Monitoring: The One Thing Companies Claim Not To Have A Budget For
  6. True Story: The Case Of A Hacked Baby Monitor (Gwelltimes P2P Cloud)
  7. Pentester’S Windows NTFS Tricks Collection
  8. TR-069: IoT Before It Was Cool!
  9. Small Business Owners: When Cybercrime Threatens Your Existence
  10. Oracle Access Manager’S Identity Crisis
  11. The Meltdown Exploit Explained (Part 1): The Basics
  12. Busting The Bad – When Criminals Scam The Wrong Company
  13. How To Successfully Fight Cybercrime On An International Scale
  14. Internet Of Babies - When Baby Monitors Fail To Be Smart
  15. Internet Of Dildos: A Long Way To A Vibrant Future – From IoT To IoD

2017 11

  1. The Art Of Fuzzing – Slides And Demos
  2. Fake Crypto: Microsoft Outlook S/MIME Cleartext Disclosure (CVE-2017-11776)
  3. Hack The Hacker – Fuzzing Mimikatz On Windows With WinAFL & Heatmaps (0day)
  4. Reverse Engineering Hardware Of Embedded Devices: From China To The World
  5. German E-Government: Details About Critical Vulnerabilities In Core Communication Library
  6. Ghosts From The Past: Authentication Bypass And OEM Backdoors In WiMAX Routers
  7. Tracking The Culprit: SEC Technologies And Fraunhofer IPK Deliver Technology To Identify Criminal Activities In Enterprise Networks
  8. Chainsaw Of Custody: Manipulating Forensic Evidence The Easy Way
  9. What Unites HP, Philips And Fujitsu? One Service And Millions Of Vulnerable Devices.
  10. Abusing NVIDIA’s Node.js To Bypass Application Whitelisting
  11. Last Call To Replace SHA-1 Certificates

2016 7

  1. Backdoor In Sony IPELA Engine IP Cameras
  2. Controlling Kerio Control – When Your Firewall Turns Against You
  3. House Of Keys: 9 Months Later… 40% Worse
  4. EU General Data Protection Regulation Comes Into Force On May 24, 2016
  5. SEC Consult Study On Smart Home Security In Germany – A First Silver Lining On The Horizon Of IoT?
  6. Deliberately Hidden Backdoor Account In Several AMX (Harman Professional) Devices
  7. McAfee Application Control – The Dinosaurs Want Their Vuln Back

2015 3

  1. House Of Keys: Industry-wide Https Certificate And SSH Key Reuse Endangers Millions Of Devices Worldwide
  2. The Omnipresence Of Ubiquiti Networks Devices On The Public Web
  3. KCODES NETUSB: HOW A SMALL TAIWANESE SOFTWARE COMPANY CAN IMPACT THE SECURITY OF MILLIONS OF DEVICES WORLDWIDE

2014 15

  1. Reflected Cross-Site Scripting in F5 BIG-IP
  2. Multiple critical vulnerabilities in Bitdefender GravityZone
  3. Multiple SSRF vulnerabilities in Alfresco Community Edition
  4. Remote Code Execution via CSRF
  5. Potential Cross-Site Scripting in ADF Faces
  6. Design Issue / Password Disclosure
  7. Multiple critical vulnerabilities in WebTitan
  8. Path Traversal/Remote Code Execution
  9. Multiple vulnerabilities in Readsoft Invoice Processing and Process Director
  10. Authentication bypass (SSRF) and local file disclosure
  11. Multiple vulnerabilities in Plex Media Server
  12. Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system
  13. Multiple vulnerabilities in Citrix NetScaler Application Delivery Controller
  14. Backdoors and direct OS command execution vulnerabilities
  15. Multiple critical vulnerabilities in Symantec LiveUpdate Administrator

2013 27

  1. Multiple severe vulnerabilities in IBM Algorithmics RICOS
  2. Multiple critical vulnerabilities in T-Mobile HOME NET Router LTE
  3. Multiple critical vulnerabilities in AVG Remote Administration
  4. Unauthenticated access & manipulation of settings in Huawei E5331 MiFi mobile hotspot
  5. Multiple critical vulnerabilities in Symantec Endpoint Protection
  6. Multiple vulnerabilities in CoSoSys Endpoint Protector 4
  7. Multiple vulnerabilities in Rhythm File Manager
  8. Stored cross-site scripting vulnerabilities
  9. Root Backdoor & Unauthenticated access to voice recordings
  10. XPath Injection in IBM Web Content Manager (WCM)
  11. SQL injection and persistent XSS
  12. SQL injection vulnerability in Zabbix
  13. Privilege escalation vulnerability in MICROSENS Profi Line Modular Industrial Switch Web
  14. Local Buffer Overflow vulnerability in SAS for Windows
  15. Undocumented password reset and admin takeover & Cross-Site Scripting vulnerabilities
  16. Multiple vulnerabilities in IceWarp Mail Server
  17. Multiple vulnerabilities in SpamTitan
  18. Multiple vulnerabilities in Sybase EAServer
  19. Nitro Pro 8 - Insecure Library Loading Allows Remote Code
  20. Multiple high risk vulnerabilities in GroundWork Monitor Enterprise (part 2)
  21. Multiple Vulnerabilities in Censornet Professional v4
  22. Multiple vulnerabilities in CTERA Portal
  23. Denial of service vulnerability in Apache CXF
  24. JavaScript Execution in WebSphere DataPower Services
  25. Multiple vulnerabilities in Sophos Web Protection Appliance
  26. Multiple critical vulnerabilities in GroundWork Monitor Enterprise (part 1)
  27. Unauthenticated setting of Java System Properties

2012 29

  1. Multiple vulnerabilities - Surveillance via Symantec Web
  2. nsconfigd NSRPC_REMOTECMD Denial of service vulnerability
  3. Vodafone EasyBox Default WPS PIN Algorithm Weakness
  4. Critical SSH Backdoor in multiple Barracuda Networks
  5. Java ActiveX Control Memory Corruption
  6. Multiple vulnerabilities in NetApp OnCommand System Manager
  7. QlikView Desktop Client Integer Overflow
  8. Applicure dotDefender WAF format string vulnerability
  9. ModSecurity multipart/invalid part ruleset bypass
  10. Persistent cross-site scripting vulnerability
  11. HTTP header injection/Cache poisoning in Oracle WebCenter
  12. Multiple vulnerabilities in Siemens OpenScape Branch
  13. Multiple high risk vulnerabilities in Shopizer webshop
  14. XML External Entity Injection (XXE) in F5 BIG-IP
  15. SQL Injection in F5 BIG-IP
  16. Multiple reflected cross-site scripting vulnerabilities in EMC Documentum eRoom
  17. Multiple Vulnerabilities in ELBA5
  18. Support Backdoor in Symantec Messaging Gateway
  19. Local file disclosure via XXE injection in Zend Framework
  20. Local file disclosure via XXE injection in Magento eCommerce Platform
  21. SQL Injection in Unirgy uStoreLocator
  22. Multiple vulnerabilities in Sosci Survey
  23. F5 FirePass SSL VPN Unauthenticated local file inclusion
  24. Multiple vulnerabilities in Oracle WebCenter Sites
  25. Airlock WAF overlong UTF-8 sequence bypass
  26. Unauthenticated remote root through SQL injection in F5 FirePass SSL VPN
  27. WD ShareSpace WEB GUI Sensitive Data Disclosure
  28. Multiple Vulnerabilities in ELBA5
  29. Multiple critical vulnerabilities in Shopizer webshop

2011 12

  1. Multiple critical vulnerabilities in Apache Struts2
  2. Client-side remote arbitrary file upload
  3. Microsoft ASP.NET Forms Authentication Bypass
  4. Microsoft ASP.NET Forms Authentication Bypass
  5. Multiple vulnerabilities in WhatsApp
  6. libwpd WPXContentListener::_closeTableRow() memory overwrite
  7. Multiple SQL Injection Vulnerabilities in WordPress
  8. Multiple permanent cross-site scripting vulnerabilities
  9. Client-side remote file upload & command execution
  10. Client-side remote file upload & command execution
  11. Multiple cross-site scripting vulnerabilities in Plone
  12. Libmodplug ReadS3M Stack Overflow

2010 2

  1. Multiple critical vulnerabilities in VOXTRONIC voxlog professional
  2. Multiple critical vulnerabilities in Sawmill Enterprise log file analysis software

2009 6

  1. Local file inclusion/execution and multiple Cross-Site-Request-Forgery vulnerabilities in LetoDMS
  2. Backdoor and Vulnerabilities in Xerox
  3. Authentication bypass and file manipulation in Sitecore Staging Module
  4. File disclosure vulnerability in JSFTemplating
  5. Novell Teaming Multiple Vulnerabilities
  6. NextApp Echo XML Injection Vulnerability

2008 12

  1. Proxy bypass vulnerability & plain text passwords
  2. Nortel Application Gateway 2000 Password
  3. Nortel Contact Center Manager Server Authentication
  4. Nortel Contact Center Manager Server Password
  5. Nortel Contact Center Manager Server Password
  6. IBM Director CIM Server Remote Denial of Service Vulnerability
  7. IBM Director CIM Server Local Privilege Escalation Vulnerability
  8. Symbian S60 / Nokia firmware media codecs multiple memory corruption vulnerabilities
  9. Fujitsu-Siemens WebTransactions Remote Command Injection
  10. Remote command execution in Instant Expert
  11. Microsoft SQL Server sp_replwritetovarbin
  12. Multiple Vulnerabilities in RADactive I-Load

2007 8

  1. Perdition IMAP proxy str_vwrite format string vulnerability
  2. Madwifi xrates element remote DOS
  3. SonicWALL Global VPN Client Format String Vulnerability
  4. PHP chunk_split() integer overflow
  5. Multiple vulnerabilities in SonicWALL SSL-VPN Client
  6. Remote command execution in Joomla! CMS
  7. Multiple vulnerabilites in Nokia Intellisync
  8. MySQL 5 Single Row Subselect Denial of Service

2006 7

  1. Apache HTTP Server / Tomcat directory traversal
  2. Remote Command Execution in TYPO3
  3. File Disclosure in Pagesetter for PostNuke
  4. SonicWALL Global Security Client Local Privilege
  5. SonicWALL Global VPN Client Local Privilege Escalation
  6. SonicOS Format String Vulnerability
  7. Opera Browser CSS Attribute Integer Wrap / Buffer Overflow

2005 17

  1. SEC-CONSULT Security Advisory 20051202-0 GMX / MSIE XSS
  2. Several XSS issues in Horde Framework, Kronolith
  3. Even More Vulnerabilities in VTiger CRM
  4. toendaCMS multiple vulnerabilites
  5. HTML Code Injection in Outlook Web Access
  6. HTML Code Injection in Outlook Web Access
  7. Snoopy Remote Code Execution Vulnerability
  8. Multiple Cross Site Scripting Vulnerabilities in OracleAS Discussion Forum Portlet
  9. File Disclosure using df_next_page parameter
  10. Symantec Enterprise Firewall NAT/HTTP
  11. Macromedia Flash Player ActionDefineFunction Memory Corruption
  12. IE6 javaprxy.dll COM instantiation heap corruption
  13. Exhibit Engine Blind SQL Injection
  14. Source Code Disclosure in Yaws Webserver
  15. Arbitrary File Inclusion in phpCMS 1.2.x
  16. Nortel SSL VPN Cross Site Scripting/Command
  17. SEC-CONSULT Security Advisory 20050401 Yahoo/MSIE XSS

2004 4

  1. Password Disclosure for SMB Shares in KDE's Konqueror
  2. Motorola Wireless Router WR850G Authentication Circumvention
  3. PHP escapeshellarg Windows Vulnerability
  4. Mehrere Fehler in LinBox

2003 3

  1. Internet Transaction Server Multiple Vulnerabilities in SAP
  2. paFileDB 3.1 OS-Cmd execution
  3. Axis Webcam DOS

Undated 341

  1. Msi installer repair to system a detailed journey
  2. Assumed breach internal threats in the cloud
  3. Investigating solaris sunos persistence using system processes
  4. Understanding dora core concepts spotlight on critical or important functions
  5. Sec consult at it sa expo 2024 a resounding success in it security
  6. Mastering dora core topics a deep dive into incident management
  7. Inside the threat a behind the scenes look at stopping an active intrusion
  8. Typo3 3.5b5 Security Check Results
  9. Invision Powerboard V.1.1.2 Multiple Vulnerabilities
  10. W-Agora Multiple Vulnerabilities
  11. SugarSales Multiple Vulnerabilities
  12. PHP Multiple Vulnerabilities
  13. Yahoo/MSIE XSS
  14. RSA ACE Web Agent XSS
  15. A Word on Webmail Security and Browser related XSS Bugs
  16. Multiple critical vulnerabilities in vizensoft admin panel
  17. Persistent cross site scripting in confluence refinedwiki original theme
  18. Xml external entity injection xxe and reflected xss
  19. Xxe xss arbitrary file write vulnerabilities
  20. Multiple critical vulnerabilities in vdg security sense
  21. Os command execution
  22. Multiple high risk vulnerabilities in netiq access manager
  23. Xss memory disclosure
  24. Multiple critical vulnerabilities in snom ip phones
  25. Privilege escalation xss missing authentication
  26. Cross site request forgery
  27. Multiple critical vulnerabilities in symantec data center security server advanced
  28. Multiple vulnerabilities in loxone smart home
  29. Multiple xss xsrf vulnerabilities
  30. Unauthenticated local file disclosure in multiple tp link products
  31. Multiple critical vulnerabilities in wso2 identity server
  32. Multiple vulnerabilities in loxone smart home part 2
  33. Kernel stack buffer overflow in kcodes netusb
  34. Critical vulnerabilities allow surveillance on conferences
  35. Permanent cross site scripting
  36. Mcafee application control multiple vulnerabilities
  37. Stack buffer overflow in handle debug network
  38. Multiple critical vulnerabilities in lime survey
  39. Insecure default configuration in various ubiquiti networks products
  40. Multiple vulnerabilities in skybox platform
  41. Deliberately hidden backdoor account in several amx devices
  42. Multiple vulnerabilities in yeager cms
  43. Multiple vulnerabilities in digitalstrom konfigurator
  44. Insecure data storage
  45. Multiple critical vulnerabilities in ubee wireless voice gateway
  46. Xss and information disclosure vulnerability
  47. Multiple vulnerabilities 13
  48. Multiple vulnerabilities in line instant messenger platform
  49. Correct answer information disclosure
  50. Multiple vulnerabilities in micro focus groupwise
  51. Manipulation of pre boot authentication
  52. Private key for browser trusted certificate embedded in firmware
  53. Potential backdoor access through multiple vulnerabilities
  54. Xml external entity injection xxe 1
  55. Multiple vulnerabilities in progress sitefinity
  56. Multiple vulnerabilities in i panda solareagle solar controller administration
  57. Denial of service heap based buffer overflow
  58. Backdoor vulnerability in sony ipela engine ip cameras
  59. Multiple critical vulnerabilities in agfeo smart home
  60. Cross site scripting xss
  61. Xss csrf vulnerabilities in multiple ubiquiti networks products
  62. Ubiquiti networks unifi cloud key multiple critical vulnerabilities
  63. Path traversal backdoor accounts knx group address on jung
  64. Xml external entity injection xxe 2
  65. Os command injection reflected cross site scripting in openemr
  66. Kathrein ufsconnect 916 multiple vulnerabilities
  67. Unauthenticated os command injection arbitrary file upload in western digital my cloud
  68. Multiple vulnerabilities in navetti pricepoint
  69. Authenticated command injection in multiple ubiquiti networks products
  70. Multiple vulnerabilities in ibm infosphere information server datastage
  71. Multiple vulnerabilities in solare datensysteme solar log
  72. Open redirect issue in multiple ubiquiti networks products
  73. Ubiquiti networks unifi cloud key authenticated command injection
  74. Misbehavior of the fsockopen function
  75. Cross site scripting xss issue in multiple ubiquiti networks products
  76. Server side request forgery ssrf vulnerability
  77. Privilege escalation due to insecure service configuration
  78. Multiple vulnerabilities in i librarian pdf manager
  79. Insecure handling of uri schemes
  80. Stack based buffer overflow
  81. Multiple critical vulnerabilities in western digital tv media player
  82. Phpbb server side request forgery vulnerability
  83. Arbitrary file upload stored xss
  84. Various wimax cpes authentication bypass vulnerabilities
  85. Access restriction bypass
  86. Xxe reflected xss in oracle financial services analytical applications
  87. Multiple reflected cross site scripting xss in ubiquiti networks products
  88. Multiple vulnerabilities in cisco prime infrastructure
  89. Multiple critical vulnerabilities 16
  90. Email verification bypass in sap e recruiting
  91. Authenticated command injection in ubiquiti networks unifi cloud key
  92. Multiple vulnerabilities in sprecher automation sprecon e c
  93. Local file disclosure in vlc media player ios app
  94. Vpn credentials disclosure in fortinet forticlient
  95. Os command injection arbitrary file upload sql injection in clipbucket
  96. Persistent cross site scripting in silverstripe cms
  97. Insecure direct object reference in testlink open source test management
  98. Multiple vulnerabilities in micro focus visibroker c
  99. Cross site scripting in webtrekk pixel
  100. Multiple vulnerabilities in linksys e series products
  101. Multiple vulnerabilities in afian ab filerun
  102. Authentication bypass in oracle access manager
  103. Multiple critical vulnerabilities in securenvoy securmail
  104. Multiple vulnerabilities in infozip unzip
  105. Authentication bypass cross site scripting in siemens sicam rtus sm 2556
  106. Xxe xss vulnerabilities in rsa authentication manager
  107. Broken access control linq injection in progress sitefinity
  108. Fortigate ssl vpn portal xss vulnerability
  109. Wago pfc 200 series critical codesys vulnerabilities
  110. Multiple cross site scripting vulnerabilities in sonatype nexus repository manager oss pro
  111. Multiple stored xss vulnerabilities in wso2 carbon and dashboard server
  112. Arbitrary file upload cross site scripting in mybiz myprocurenet
  113. Multiple critical vulnerabilities in whole vibratissimo smart sex toy product range
  114. Reflected cross site scripting in zxel zywall
  115. Arbitrary shortcode execution local file inclusion in woof pluginus net
  116. Hijacking of arbitrary misafes mi cam video baby monitors
  117. Unprotected wifi access unencrypted data transfer in vgate icar2 wifi obd2 dongle
  118. Multiple critical vulnerabilities in miss marple enterprise edition
  119. Signature bypass authentication bypass in governikus autent sdk
  120. Authorization bypass in all adb broadband gateways routers
  121. Local root jailbreak via network file sharing flaw in all adb broadband gateways routers
  122. Privilege escalation via linux group manipulation in all adb broadband gateways routers
  123. Remote code execution via multiple attack vectors in wago edisplay
  124. Remote code execution local file disclosure zeta producer desktop cms
  125. Vulnerability in skype for business lync might lead to denial of service attack
  126. Multiple vulnerabilities in siglent technologies sds 1202x e digital oscilloscope
  127. Sql injection xss csrf vulnerabilities in pimcore software
  128. Dokuwiki csv formula injection vulnerability
  129. Remote code execution php unserialize moodle open source learning platform cve 2018 14630
  130. Multiple vulnerabilities citrix storagezones controller cve 2018 16968 cve 2018 16969
  131. Stored cross site scripting in kendo ui editor cve 2018 14037
  132. Password disclosure vulnerability xss in ptc thingworx
  133. Vulnerabilities xiongmai ip cameras nvrs dvrs cve 2018 17915 cve 2018 17917 cve 2018 17919
  134. Inadequate cryptography implementation in kerio control
  135. Multiple vulnerabilities in openpgp js
  136. Vulnerabilities in cisco voip phones cve 2018 0461
  137. Cross site scripting in ca automic workload automation web interface formerly automic automation engine
  138. Multiple vulnerabilities in osci transport library 1 2 for german egovernment
  139. Weak configuration file encryption in avaya one x communicator
  140. Multiple vulnerabilities in wago 852 industrial managed switch series cve 2019 12550 cve 2019 12549
  141. Cleartext message spoofing in go cryptography libraries cve 2019 11841
  142. Unauthenticated sql injection vulnerability in openproject cve 2019 11600
  143. Multiple vulnerabilities in gemalto thales group ds3 authentication server ezio server
  144. Hardcoded ftp credentials in zyxel wireless access point series
  145. External dns requests in zyxel usg uag atp vpn nxc series
  146. Unauthenticated sensitive information leakage in zoho servicedesk software
  147. Stored and reflected xss vulnerabilities in limesurvey cve 2019 16172 cve 2019 16173
  148. Multiple vulnerabilities in cisco router series rv34x rv26x and rv16x
  149. Authorization bypass vulnerability in rsa netwitness cve 2019 3724
  150. Reflected cross site scripting xss in oracle mojarra jsf
  151. Multiple sql injection vulnerabilities in ebrigade
  152. Reflected xss vulnerability in openproject cve 2019 17092
  153. https://sec-consult.com/vulnerability-lab/advisory/15587/
  154. Weak encryption cipher and hardcoded cryptographic keys in fortinet products
  155. Multiple critical vulnerabilities in salto proaccess space
  156. Multiple vulnerabilites in fronius solar inverter series cve 2019 19229 cve 2019 19228
  157. Reflected xss in zoho manageengine servicedesk plus
  158. Cross site request forgery csrf in umbraco cms
  159. Multiple cross site scripting xss vulnerabilities in php fusion cms
  160. Authenticated command injection in phoenix contact tc router tc cloud client
  161. Multiple xss vulnerabilities in tao open source assessment platform
  162. Reflected cross site scripting xss in eqdkp plus cms
  163. Multiple critical vulnerabilities in multiple rittal products based on same software
  164. Multiple vulnerabilities in wondercms
  165. Privilege escalation vulnerability in steelcentral aternity agent
  166. Stored cross site scripting xss vulnerability in namirial significant signanywhere
  167. Multiple vulnerabilities in flatcore cms
  168. Extensive file permissions on service executable in eikon thomson reuters cve 2019 10679
  169. Multiple vulnerabilities in zte mobile hotspot ms910s cve 2019 3422
  170. Multiple vulnerabilities in red lion n tron 702 w red lion n tron 702m12 w
  171. Broken access control in platinum mobile
  172. Multiple vulnerabilities in sevone network management system nms
  173. Multiple critical vulnerabilities in rocketlinx series
  174. Multiple cross site scripting vulnerabilities in confluence marketplace plugins
  175. Reflected cross site scripting and unauthenticated malicious file upload in sage dpw 1
  176. Multiple vulnerabilities in publixone
  177. Default 6e76ff9947
  178. Vulnerabilities in trend micro interscan messaging security virtual appliance imsva
  179. Blind out of band xml external entity injection in avaya web license manager
  180. Multiple vulnerabilities in zte wlan router mf253v
  181. Multiple critical vulnerabilities in trend micro interscan web security virtual appliance
  182. Multiple high risk vulnerabilities in flatcore cms
  183. Multiple vulnerabilities in pepperl fuchs io link master series
  184. Reflected xss vulnerability magento2
  185. Multiple vulnerabilities irfanview wpg
  186. Authentication bypass genua genugate
  187. Arbitrary file upload and bypassing htaccess rules in monospace directus headless cms
  188. Reflected xss in microsoft azure devops server
  189. Stored cross site scripting outdated software library in bmdweb 2
  190. Reflected xss vulnerabilities in sis informatik rewe go
  191. Multiple critical vulnerabilities in korenix technology westermo pepperl fuchs
  192. Authentication bypass remote code execution in schneider electric evlink charging stations
  193. Critical vulnerabilities in altus sistemas de automacao products
  194. Multiple vulnerabilities in netmodule router software nrsw
  195. Authenticated rce in bscw server
  196. Xml tag injection in bscw server
  197. Multiple vulnerabilities in moxa devices
  198. Critical vulnerabilities in hikam high infinity technology
  199. Codesys v2 denial of service
  200. Reflected cross site scripting vulnerability in ibm sterling b2b integrator
  201. Multiple vulnerabilities in bscw server
  202. Multiple vulnerabilities in abantecart e commerce platform
  203. Stored cross site scripting in sofico miles ria
  204. Remote abap code injection in sap netweaver iuuc generate acplan delimiter
  205. Remote adbc sql injection in sap netweaver
  206. Remote abap code injection in sap netweaver
  207. Cleartext storage of phone password in cisco ip phones
  208. Stored cross site scripting vulnerability in typo3 extension femanager
  209. Local file inclusion vulnerability in land software faust iserver
  210. Authenticated path traversal in ethercreative logs plugin for craft cms
  211. Denial of service user enumeration in wago 750 8xxx plc
  212. Multiple critical vulnerabilities in korenix technology jetwave products
  213. Broken access control cross site scripting in shopmetrics mystery shopping software
  214. Open redirect in login page in siemens sinema remote connect
  215. Multiple critical vulnerabilities in multiple zyxel devices
  216. Missing authentication at file download denial of service in siemens a8000
  217. Privilege escalation miele benchmark programming tool
  218. Password reset poisoning attack craft cms
  219. Sandbox escape with root access clear text passwords in konica minolta bizhub mfp printer terminals
  220. Critical vulnerabilities in sap application server and platform
  221. Backdoor account in korenix technology jetport series
  222. Critical vulnerabilities poly eagleeye director ii
  223. Authenticated command injection in poly studio
  224. Memory corruption vulnerabilities dbus broker
  225. Infiray iray thermal camera multiple vulnerabilities
  226. Multiple vulnerabilies in gentics cms
  227. Multiple vulnerabilities softguard network management extension snmp
  228. Reflected xss in siemens sinema remote connect
  229. Hardcoded backdoor user outdated software components nexans ftto gigaswitch
  230. Outdated javascript engine leads to rce in foxit pdf reader
  231. Improper access control in sap saprouter
  232. Local privilege escalation in sap sapcontrol web service interface sapuxuserchk
  233. Local privilege escalation in sap sybase sybctrl
  234. Multiple memory corruption vulnerabilities in covesa dlt daemon
  235. Multiple critical vulnerabilities in simmeth system gmbh lieferantenmanager
  236. Html injection in bmc remedy itsm suite
  237. Path traversal vulnerability in payara platform
  238. Multiple critical vulnerabilities in planet enterprises ltd planet estream
  239. Replay attacks displaying arbitrary contents in zhuhai suny technology esl tag etag tech protocol electronic shelf labels
  240. Multiple critical vulnerabilities in ilias elearning platform
  241. Privilege escalation vulnerabilities unix insecure file handling sap saposcol
  242. Remote code execution bypass eclipse business intelligence reporting birt
  243. Pre authenticated remote code execution in csexe opentext server component
  244. Multiple post authentication vulnerabilities including rce opentexttm extended ecm
  245. Pre authenticated remote code execution via java frontend qds endpoint opentext extended ecm
  246. Multiple xss vulnerabilities in br systems diagnostics manager
  247. Os command injection in barracuda cloudgen wan
  248. Reflected cross site scripting in cisco unified call manager
  249. Multiple vulnerabilities in arris dg3450 cable gateway
  250. Bypassing cluster isolation in databricks platform
  251. Multiple vulnerabilities in kiddoware kids place parental control android app
  252. Multiple vulnerabilities in serenity and startsharp software
  253. Stored xss vulnerability in rename functionality in wekan open source kanban
  254. Multiple high risk vulnerabilities in ilias elearning platform
  255. App restriction bypass and other vulnerabilities in boomerang parental control app
  256. Multiple vulnerabilities siemens a8000
  257. Path traversal bypass denial of service in kyocera printer
  258. Reflected cross site scripting xss in codebeamer alm solution by ptc
  259. Authenticated remote code execution missing authentication atos unify openscape
  260. Stored cross site scripting in mb support broker management solution openviva c2
  261. Multiple vulnerabilities in sap enable now manager
  262. Open redirect in bsp test application it00 bypass for cve 2020 6215 patch
  263. Multiple vulnerabilities in m privacy tightgate pro
  264. Uninstall key caching in fortra digital guardian agent uninstaller
  265. Missing certificate validation user enumeration
  266. Argument injection vulnerability in multiple atos unify openscape products
  267. Kiosk escape privilege escalation one identity password manager secure password extension
  268. Local privilege escalation via msi installer in pdf24 creator geek software gmbh
  269. Multiple stored cross site scripting vulnerabilities
  270. Mutiple stored cross site scripting vulnerabilities in openolat frentix gmbh
  271. Local privilege escalation via dll hijacking in qognify vms client viewer
  272. Local privilege escalation via writable files in checkmk agent
  273. Database passwords in server response in amazon aws glue
  274. Broken authorization in dreamehome app
  275. Tolerating self signed certificates in sap cloud connector
  276. Broken access control api information exposure in 4bro app
  277. Exposed serial shell on multiple plcs in siemens cp xxxx series
  278. Multiple vulnerabilities in hawki
  279. Multiple critical vulnerabilities in kiuwan sast on premise kop cloud saas kiuwan local analyzer
  280. Arbitrary file upload in edu sharing metaventis gmbh
  281. Multiple vulnerabilities allowing complete bypass in faronics winselect standard enterprise
  282. Multiple vulnerabilities in siemens power automation products cp 8000 cp 8021 cp8 022 cp 8031 cp 8050 sicore
  283. Local privilege escalation via msi installer in softmaker office freeoffice
  284. Uninstall password bypass in blackberry cylanceoptics windows installer package
  285. Local privilege escalation via msi installer in nitro pdf pro
  286. Local privilege escalation via msi installer in palo alto networks globalprotect
  287. Multiple vulnerabilities in rittal iot interface cmc iii processing unit
  288. Authenticated remote code execution in multiple xerox printers
  289. Unauthenticated path traversal vulnerability in lawo ag vsm ltc time sync vtimesync
  290. Query filter injection in ping identity pingidm formerly known as forgerock identity management
  291. Multiple vulnerabilities in hasomed elefant and elefant software updater
  292. Multiple vulnerabilities in siemens energy omnivise t3000
  293. Unlocked jtag interface and buffer overflow in siemens sm 2558 protocol element
  294. Stored cross site scripting in omada identity
  295. Multiple critical vulnerabilities in image access scan2net
  296. Reflected cross site scripting in numerix license server administration system login
  297. Wind river software vxworks rtos weak password hashing algorithms
  298. Multiple vulnerabilities in wattsense bridge
  299. Multiple vulnerabilities in siemens a8000 cp 8050 and cp 8031 plc
  300. Ivanti endpoint manager local privilege escalation via dll search order hijacking
  301. Multiple vulnerabilities in hp wolf security controller hp sure access enterprise hp sure click enterprise
  302. Honeywell mb secure authenticated command injection
  303. Multiple vulnerabilities in echarge hardy barth cph2 and cpp2 charging stations
  304. Local privilege escalation and default credentials in medical office demo by indamed
  305. Undocumented root shell access on simcom modem
  306. Reflected cross site scripting in onlyoffice docs documentserver
  307. Multiple stored cross site scripting vulnerabilities in optimizely episerver content management system
  308. Race condition in shopware voucher submission
  309. Nfc card vulnerability exploitation leading to free top up kiosoft payment solution
  310. Unauthenticated sql injection vulnerability in shibboleth service provider sp odbc interface
  311. Missing certificate validation leading to rce in clevercontrol employee monitoring software
  312. Multiple vulnerabilities in imonitorsoft eam
  313. Multiple vulnerabilities in efficientlab workexaminer professional
  314. Unauthenticated local file disclosure in mpdv mikrolab mip 2 fedra 2 hydra x manufacturing execution system
  315. Unprotected nfc card manipulation leading to free top up in giroweb cashless catering solutions of legacy customer infrastructure
  316. Multiple critical vulnerabilities in dormakaba access manager
  317. Multiple critical vulnerabilities in dormakaba kaba exos 9300
  318. Uart leaking sensitive data in dormakaba registration unit 9002 pin pad
  319. Multiple vulnerabilities in native instruments native access macos
  320. Multiple vulnerabilities in various solax power pocket wifi models
  321. Multiple critical vulnerabilities in nestersoft worktime on prem cloud
  322. Multiple vulnerabilities in cpsd cryptopro secure disk for bitlocker
  323. Multiple vulnerabilities in pega infinity platform
  324. Multiple privilege escalation vulnerabilities in arturia software center macos
  325. Local privilege escalation in vienna assistant macos vienna symphonic library
  326. Broken access control in open webui
  327. Improper enforcement of locked accounts in webui sso in kiuwan sast on premise kop cloud saas
  328. Exposed private key of x509 certificate in sap hana cockpit sap hana database explorer
  329. Broken access control in config endpoint in litellm
  330. Dll hijacking in efficientlab controlio cloud based employee monitoring service
  331. Missing tls certificate validation leading to rce in desktime time tracking app
  332. Privilege escalation via binary planting in genetec provided rabbitmq in multiple genetec products
  333. Multiple local privilege escalation vulnerabilities in waves audio waves central
  334. Local privilege escalation in slate digital connect
  335. Multiple vulnerabilities in wertheim safecontroller hardware for vault rooms safe deposit locker system microcontroller
  336. Multiple critical vulnerabilities in wertheim safecontroller software for vault rooms safe deposit locker system
  337. Broken access control in syracom ag secure login 2fa for atlassian jira confluence bitbucket
  338. Multiple critical vulnerabilities in sprecher automation sprecon e c e p e t3
  339. Multiple vulnerabilities in quanos content solutions schema st4
  340. Hardcoded root cloud credentials in application binaries in silver leaf technologies worksnaps
  341. Local privilege escalation in honeywell iq multiaccess update service