1312 matches found
CVE-2022-41329
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations ...
CVE-2022-41329
The CVE-2022-41329 issue is confirmed in Fortinet FortiProxy and FortiOS products, where an unauthenticated attacker can obtain sensitive logging information via crafted HTTP GET requests. Affected: FortiProxy 7.2.0–7.2.1 and 7.0.0–7.0.7; FortiOS 7.2.0–7.2.3 and 7.0.0–7.0.9. Root cause: exposure ...
CVE-2023-23776
CVE-2023-23776 describes an information disclosure in FortiAnalyzer where a remote authenticated attacker can read the client machine password in plaintext in the heartbeat response during a log-fetch request. Affected FortiAnalyzer versions: 7.2.0–7.2.1, 7.0.0–7.0.4, and 6.4.0–6.4.10. The issue ...
CVE-2023-23776
An exposure of sensitive information to an unauthorized actor CWE-200 vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when ...
FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch - Information disclosure through diagnose debug commands
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch may allow an attacker which has obtained access to a restricted administrative account to obtain sensitive information via diagnose debug commands...
JVN#19872280: Multiple vulnerabilities in PostgreSQL extension module pg_ivm
pgivm provided by IVM Development Group is a PostgreSQL extension module that provides incremental view maintenance functionality of materialized views. pgivm contains multiple vulnerabilities listed below. Exposure of sensitive information to an unauthorized actor CWE-200 - CVE-2023-22847 An...
CVE-2023-0053
SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could...
CISA Releases Fifteen Industrial Control Systems Advisories
CISA released fifteen 15 Industrial Control Systems ICS advisories on February 16, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories f...
CVE-2023-23458
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request...
SUSE CVE-2009-1836
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying...
CVE-2023-23458 Sunell DVR – Exposure of Sensitive Information
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request...
CVE-2023-23458
Sunell DVR (latest version) is affected by CVE-2023-23458, which involves CWE-200: Exposure of Sensitive Information to an Unauthorized Actor from an unspecified request. The NVD entry documents a network-accessible issue with low attack complexity and low privileges required, leading to potentia...
CVE-2023-23458 Sunell DVR – Exposure of Sensitive Information
Sunell DVR, latest version, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor through an unspecified request...
Wago PFC200 iocheckd service 'I/O-Check' cache DNS code execution vulnerability (CVE-2019-5166)
An exploitable stack buffer overflow vulnerability exists in the iocheckd service I/O-Check' functionality of WAGO PFC 200 version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in code execution. An attacke...
Wago PFC200 iocheckd service 'I/O-Check' cache Code Execution (CVE-2019-5181)
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service I/O-Check' functionality of WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in cod...
Wago PFC200 iocheckd service 'I/O-Check' cache Command Injection (CVE-2019-5167)
An exploitable command injection vulnerability exists in the iocheckd service I/O-Check' function of the WAGO PFC 200 version 03.02.0214. At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/editdnsserver %s dns-server-nr=%d dns- server-name= using...
WAGO I/O-CHECK Missing Authentication For Critical Function (CVE-2019-5077)
An exploitable denial-of-service vulnerability exists in the iocheckd service 'I/O-Chec'' functionality of WAGO PFC 200 Firmware versions 03.01.0713 and 03.00.3912, and WAGO PFC 100 Firmware version 03.00.3912. A specially crafted set of packets can cause a denial of service, resulting in the...
Wago PFC200 iocheckd service 'I/O-Check' cache Code Execution (CVE-2019-5178)
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service I/O-Check' functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is...
Wago PFC 200 Web-Based Management Code Execution (CVE-2020-6090)
An exploitable code execution vulnerability exists in the Web-Based Management WBM functionality of WAGO PFC 200 03.03.1015. A specially crafted series of HTTP requests can cause code execution resulting in remote code execution. An attacker can make an authenticated HTTP request to trigger this...