Sealevel Systems, Inc. SeaConnect 370W Web Server information disclosure vulnerability

Summary An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger...

Mageia: Security Advisory (MGASA-2017-0371)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Accesspress Basic theme <= 3.2.1 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Accesspress Basic theme versions = 3.2.1. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

CVE-2021-43298

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until...

CVE-2021-43298

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until...

CVE-2021-43298

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until...

CVE-2021-43298

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until...

PT-2022-11817

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue concerns the password matching mechanism used in 'Basic' HTTP authentication. It does not utilize a constant-time comparison, such as memcmp, and lacks rate-limiting. This...

CVE-2021-43298: Observable Timing Discrepancy

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until...

Embedthis Software GoAhead security vulnerabilities

Embedthis Software GoAhead is an embedded Web server from Embedthis Software. A security vulnerability exists in Embedthis Software GoAhead, which stems from the fact that the code that performs password matching during "basic" HTTP authentication does not use the constant time memcmp and is not...

WordPress Accesspress Basic theme <= 3.2.1 - Cross-Site Request Forgery (CSRF) leading to Arbitrary Plugin Activation/Deactivation

Cross-Site Request Forgery CSRF leading to Arbitrary Plugin Activation/Deactivation discovered by Ex.Mi Patchstack in WordPress Accesspress Basic theme versions = 3.2.1. Solution Deactivate and delete. The vendor ignores the vulnerability reports avoids any conversation...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

CVE-2021-43269

In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config PAC file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. Incydr...

CVE-2021-43269

In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config PAC file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. Incydr...

PT-2022-11809

Name of the Vulnerable Software and Affected Versions Code42 app versions prior to 8.8.0 Incydr Basic versions prior to 8.8.0 Incydr Advanced versions prior to 8.8.0 Incydr Gov F1 versions prior to 8.8.0 CrashPlan Cloud versions prior to 8.8.0 CrashPlan for Small Business versions prior to 8.8.0...

CVE-2021-43269: Improper Control of Generation of Code

In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config PAC file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; CrashPlan Cloud; and CrashPlan for Small Business. Incydr...

PT-2022-3584

Name of the Vulnerable Software and Affected Versions SIMATIC Energy Manager Basic versions prior to V7.3 Update 1 SIMATIC Energy Manager PRO versions prior to V7.3 Update 1 Description The issue is related to the improper assignment of permissions to critical directories and files used by the...

CVE-2022-22530

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being...

Siemens COMOS Web (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: COMOS Vulnerabilities: Basic XSS, Relative Path Traversal, SQL Injection, Cross-site Request Forgery 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update...

Google Chrome UI Manipulation

The vulnerability of the basic authentication user interface of Google Chrome is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to forge the URL content using a specially created HTML page...