en
HVN Group - Hệ sinh thái kiến tạo doanh nghiệp 4.0
HVN Group - dẫn đầu về dịch vụ nền tảng số cho doanh nghiệp. Hỗ trợ doanh nghiệp ứng dụng công nghệ vào chuyển đổi số giúp doanh nghiệp vận hành hiệu quả
IndustryOriginGlobal rankRank in Vietnam
Updated at The score and grade reflect the result recorded at scan time. Review each check and its evidence for the full context.
This report summarizes the security observations recorded for hvn.vn at scan time. Review each check and its evidence for the full context.
At assessment time, CyStack did not find hvn.vn or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.
Data sources
CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the enterprise.
These 3 failed checks or warnings have the greatest impact on the result for hvn.vn.
Why it matters
Remote administration services such as RDP, VNC, Docker, Kubernetes, and management consoles are high-value targets. Public exposure allows anyone on the Internet to attempt passwords or exploit an unpatched service.
What to do
Remove direct Internet access and require a VPN, a hardened access gateway, or trusted source networks; also use MFA where supported.
Evidence and check scope
Why it matters
Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.
What to do
Listen only on private interfaces, allow connections only from required application systems, and require strong authentication and encryption.
Why it matters
Older services such as Telnet, FTP, and unencrypted mail or directory protocols can send passwords and data in readable form. Anyone able to observe the network path may capture them.
What to do
Disable the legacy service or replace it with an encrypted alternative such as SSH, SFTP, HTTPS, or the secure version of the mail protocol.
Each public IP is grouped with its open services, identified products and any CVEs that may apply to the observed version.
103.124.95.203
Openssh13 potential CVEsOpenssh
DovecotVersion not visibleEvidence and check scope
Evidence and check scope
Potential CVEs for this product
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
NvdIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
NvdOpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
NvdIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Nvdsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
NvdOpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
Nvdsshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
Nvdsshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
Nvdsftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Nvdscp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
Nvdinternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
NvdIn sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
NvdOpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
NvdProduct not identified
Authoritative ServerAuthoritative Server4.9.16
nginxnginxVersion not visibleDovecotDovecotVersion not visibleProduct not identified
PixelyoursiteA
AkismetE
Emerald For Ux+314 potential CVEsPixelyoursiteWordpress Plugin · Analytics · WordPress Plugins0.2.34 potential CVEsCVSS 5.4PixelyourSite is now probably the most complex tracking tool for WordPress, managing the Facebook Pixel, Google Analytics, Google Ads Remarketing, Pinterest Tag, Bing Tag, and virtually any other script.
www.pixelyoursite.com
Exim2 potential CVEsExim4.99.42 potential CVEsCVSS 7.8Potential CVEs for this product
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
NvdProduct not identified
DovecotDovecotVersion not visible
MariadbMariadb11.4.12Potential CVEs for this product
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
NvdThe PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
NvdImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1.
NvdCross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions.
NvdAkismetWordpress Plugin1784191574Emerald For UxWordpress Plugin1720254968
Flatsome ChildWordpress Theme1784191572
FluentformWordpress Plugin1784191572
Post Views CounterWordpress Plugin1784191572
Quote GenWordpress Plugin1784191572
Real3d Flipbook LiteWordpress Plugin1784191574
Google AnalyticsAnalyticsVersion not visibleGoogle Analytics is a free web analytics service that tracks and reports website traffic.
google.com/analytics
Google Site KitWordpress PluginVersion not visible
Google Tag ManagerTag ManagersVersion not visibleGoogle Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com/tagmanager
HTTP/3MiscellaneousVersion not visibleHTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.org
jQueryJavaScript LibrariesVersion not visiblejQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.com
LiteSpeedWeb ServersVersion not visibleLiteSpeed is a high-scalability web server.
litespeedtech.comLiteSpeed CacheCaching · WordPress PluginsVersion not visibleLiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.
www.litespeedtech.com/products/cache-plugins/wordpress-acceleration
MySQLDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.com
NginxReverse Proxies · Web ServersVersion not visibleNginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org/en
PHPProgramming LanguagesVersion not visiblePHP is a general-purpose scripting language used for web development.
php.net
RedisDatabasesVersion not visibleRedis is an in-memory data structure project implementing a distributed, in-memory key–value database with optional durability. Redis supports different kinds of abstract data structures, such as strings, lists, maps, sets, sorted sets, HyperLogLogs, bitmaps, streams, and spatial indexes.
redis.io
Redis Object CacheCachingVersion not visible
Site KitAnalytics · WordPress Plugins1.183.0Site Kit is a one-stop solution for WordPress users to use everything Google has to offer to make them successful on the web.
sitekit.withgoogle.com
WooCommerceEcommerce · WordPress Plugins1784191574WooCommerce is an open-source ecommerce plugin for WordPress.
woocommerce.com
WP RocketCaching · WordPress PluginsVersion not visibleWP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.
wp-rocket.meWP RocketWordpress Plugin · Caching · WordPress PluginsVersion not visibleWP Rocket is a caching and performance optimisation plugin to improve the loading speed of WordPress websites.
wp-rocket.me
Ajax Search For WoocommerceWordpress Plugin1.33.0
Easy Table Of ContentsWordpress Plugin2.0.85
FlatsomeWordpress Theme3.20.8
FluentformproWordpress Plugin24.2.0
Hvn Ux BuilderWordpress Plugin1.0.0
Hvn Woo Cuz FieldWordpress Plugin1.0.0
Kk Star RatingsWordpress Plugin5.4.10.5
OnetapWordpress Plugin1.1.9
WoocommerceWordpress Plugin2.7.0-wc.10.9.4
WordPressBlogs · CMS6.9.5WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.orgExim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
NvdRecently completed assessments, prioritizing websites with a similar sector, country or security grade for easier comparison.
Vietnam
