en
Học viện Công nghệ Bưu chính Viễn thông – Cơ sở Giáo dục Đại học trọng điểm Quốc gia về kỹ thuật, công nghệ
Học viện Công nghệ Bưu chính Viễn thông - Cơ sở Giáo dục Đại học trọng điểm Quốc gia về kỹ thuật, công nghệ
IndustryOriginGlobal rankRank in Vietnam
Updated at The score and grade reflect the result recorded at scan time. Review each check and its evidence for the full context.
This report summarizes the security observations recorded for ptit.edu.vn at scan time. Review each check and its evidence for the full context.
At assessment time, CyStack did not find ptit.edu.vn or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.
Data sources
CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the enterprise.
These 3 failed checks or warnings have the greatest impact on the result for ptit.edu.vn.
Why it matters
A possible CVE match also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means attackers have used that vulnerability in real incidents. The match is urgent to investigate, but the installed software still needs to be confirmed as affected.
What to do
Verify the installed product immediately and follow the CISA and vendor instructions for mitigation, patching, or upgrading if it is affected.
Evidence and check scope
16 additional evidence fields are not shown here.
Why it matters
Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.
What to do
Listen only on private interfaces, allow connections only from required application systems, and require strong authentication and encryption.
Why it matters
Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.
What to do
Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.
Each public IP is grouped with its open services, identified products and any CVEs that may apply to the observed version.
103.9.211.85
Nginx2 potential CVEsNginx
LiteSpeed Web ServerVersion not visibleEvidence and check scope
Evidence and check scope
References
Potential CVEs for this product
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
NvdWhen multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Nvd
jQueryE
Elementor ProE
Elementor+245 potential CVEsjQueryJavaScript Libraries1.11.04 potential CVEsKEVCVSS 6.1jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
NginxNginxReverse Proxies · Web Servers1.29.8Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org/en
Mariadb9 potential CVEsMariadb10.11.159 potential CVEsCVSS 9.8Potential CVEs for this product
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
NvdLiteSpeed Web ServerLiteSpeed Web ServerVersion not visiblePotential CVEs for this product
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
NvdjQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
NvdjQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
NvdIn jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
NvdElementor ProWordpress Plugin3.21.21 potential CVEsCVSS 6.1Potential CVEs for this product
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2.
NvdElementorPage Builders · WordPress Plugins · Wordpress Plugin3.22.3Elementor is a website builder platform for professionals on WordPress.
elementor.com
Font AwesomeFont ScriptsVersion not visibleFont Awesome is a font and icon toolkit based on CSS and Less.
fontawesome.com
Google AnalyticsAnalyticsVersion not visibleGoogle Analytics is a free web analytics service that tracks and reports website traffic.
google.com/analytics
imagesLoadedJavaScript Libraries5.0.0jQuery plugin for seeing if the images are loaded.
imagesloaded.desandro.comjQuery CDNCDNVersion not visiblejQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.
code.jquery.comjQuery MigrateJavaScript Libraries3.4.1Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.
github.com/jquery/jquery-migrate
jsDelivrCDNVersion not visibleJSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.
www.jsdelivr.com
LiteSpeedWeb ServersVersion not visibleLiteSpeed is a high-scalability web server.
litespeedtech.comLiteSpeed CacheCaching · WordPress PluginsVersion not visibleLiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.
www.litespeedtech.com/products/cache-plugins/wordpress-acceleration
MySQLDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.comNginxReverse Proxies · Web ServersVersion not visibleNginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org/en
OWL CarouselJavaScript LibrariesVersion not visibleOWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.
owlcarousel2.github.io/OwlCarousel2
PHPProgramming LanguagesVersion not visiblePHP is a general-purpose scripting language used for web development.
php.net
PopperMiscellaneousVersion not visiblePopper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.
popper.js.org
SlickJavaScript LibrariesVersion not visible
Underscore.jsJavaScript Libraries1.13.7Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes.
underscorejs.org
Bai Viet Giao VuWordpress Plugin6.9.5
GimontWordpress Theme1.0.9
Gimont ChildWordpress Theme1.0.0
Hinh Anh Sinh VienWordpress Plugin1.0
Khcn HtqtWordpress Plugin6.9.5NginxReverse Proxies · Web Servers1.29.8Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org/en
Ova EventsWordpress Plugin6.9.5
Tin Tuc Su KienWordpress Plugin6.9.5
WordPressBlogs · CMS6.9.5WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.orgMariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
NvdMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
NvdMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
NvdMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
NvdMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
NvdAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.
NvdIn MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
NvdMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
NvdRecently completed assessments, prioritizing websites with a similar sector, country or security grade for easier comparison.
Vietnam
