73 matches found
ICSMA-21-196-01_Ypsomed mylife
1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Ypsomed Equipment: mylife Cloud, mylife Mobile Application Vulnerabilities: Insufficiently Protected Credentials, Not Using an Unpredictable IV with CBC Mode, Use of Hard-coded Credentials 2. RISK...
Schneider Electric Modicon Controllers and Software (Update A)
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor : Schneider Electric Equipment : EcoStruxure Control Expert, EcoStruxure Process Expert, SCADAPack RemoteConnect x70, SCADAPack x70 RTUs, and Modicon M580 and M340 control products Vulnerabilities :...
CVE-2020-28219
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1 and EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551....
CVE-2020-28219
CVE-2020-28219 affects EcoStruxure Geo SCADA Expert 2019 and 2020, with a CWE-522 vulnerability that could expose credentials to server-side users when web users are logged in to Virtual ViewX. Affected versions include EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates throu...
CVE-2020-28219
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1 and EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551....
02-522-5050.com Cross Site Scripting vulnerability OBB-1419180
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
02-522-5050.com Cross Site Scripting vulnerability OBB-1408303
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
02-522-5050.com Cross Site Scripting vulnerability OBB-1398198
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GitHub Security Lab: Java: CWE-522 Insecure basic authentication
This bug was reported directly to GitHub Security Lab...
ogusta.com Cross Site Scripting vulnerability
Security Researcher error404 Helped patch 522 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting ogusta.com website and its users. Following coordinated an...
nvlinens.com Cross Site Scripting vulnerability
Security Researcher error404 Helped patch 522 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting nvlinens.com website and its users. Following coordinated...
D-Link 6600-AP XSS / DoS / Information Disclosure Vulnerabilities
Exploit for hardware platform in category web applications Security Advisory - 22/07/2019 Multiple vulnerabilities found in the D-Link 6600-AP device running the latest firmware version 4.2.0.14. D-Link 6600-AP is not produced anymore but the support is still provided by D-Link as per described o...
Low severity vulnerability that affects sensu
The sensu rubygem prior to version 1.2.0 contains a CWE-522 Insufficiently Protected Credentials flaw that can result in sensitive configuration data e.g. passwords being logged in clear-text. Users are advised to upgrade to rubygem version 1.2.1 or later...
CVE-2018-8212
A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers...
Trend Micro IMSVA Management Portal 9.1.0.1600 Authentication Bypass Exploit
Trend Micro IMSVA Management Portal version 9.1.0.1600 suffers from an authentication bypass vulnerability. Title: Trend Micro IMSVA Management Portal Authentication Bypass Advisory ID: KL-001-2018-006 Publication Date: 2018.02.08 Publication URL:...
CVE-2018-1000060
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...
CVE-2018-1000060
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...
Design/Logic Flaw
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...
CVE-2018-1000060
CVE-2018-1000060 affects Sensu Core prior to 1.2.0 (and before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b). The root cause is Sensu::Utilities.redact_sensitive() failing to redact sensitive data in deeply nested structures, causing passwords and other credentials to be logged in clear-text i...
CVE-2018-1000060
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...