CVE-2019-19292

CVE-2019-19292 affects Siemens CCS (Control Center Server): SQL injection in the XML-based protocol on ports 5444/TCP and 5440/TCP affecting all CCS versions before v1.5.0. An authenticated remote attacker could read/modify the CCS database and potentially perform administrative database operatio...

WAGO PFC200 Cloud Connectivity Improper Host Validation Vulnerability

Summary An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An...

WAGO e!Cockpit network communication cleartext transmission vulnerability

Summary A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit, version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or destined for e!Cockpit. This includes passwords,...

Cisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery Vulnerability

According to its self-reported version number, the version of Cisco TelePresence Video Communication Server is affected by an input- validation flaw that allows server-side request forgery SSRF leading to arbitrary network requests from the affected device. TRUSTED...

CVE-2020-9550

Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely...

Design/Logic Flaw

Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely...

CVE-2020-9550

Rubetek SmartHome 2020 devices expose a vulnerability (CVE-2020-9550) due to unencrypted 433 MHz communication between controllers and beacons. This design allows an attacker to sniff beacon traffic and remotely spoof beacon requests. The vulnerability is reported across multiple feeds (NVD entry...

CVE-2020-9550

Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely...

The vulnerability of the K7TSHlpr.dll module in antivirus protection tools such as K7 Antivirus Premium, K7 Total Security, and K7 Ultimate Security allows attackers to escalate their privileges.

The vulnerability of the K7TSHlpr.dll module in antivirus protection tools such as K7 Antivirus Premium, K7 Total Security, and K7 Ultimate Security is related to errors in inter-process communication. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

CVE-2020-4283

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 1762...

CVE-2020-4283

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 1762...

Hardcoded credentials

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 1762...

The Long Path out of the Vulnerability Disclosure Dark Ages

Letting a company know about flaws in their products has gotten easier since 2003—but not by much...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

Cross site scripting

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

CVE-2020-8127 affects reveal.js 3.9.1 and earlier, where insufficient validation in cross-origin postMessage enables cross-site scripting. Impact is limited to affected reveal.js usage; exploits are not detailed here. Remediation: upgrade to reveal.js 3.9.2 or later. This vulnerability is confirm...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

New LTE Network Flaw Could Let Attackers Impersonate 4G Mobile Users

A group of academics from Ruhr University Bochum and New York University Abu Dhabi have uncovered security flaws in 4G LTE and 5G networks that could potentially allow hackers to impersonate users on the network and even sign up for paid subscriptions on their behalf. The impersonation attack —...

Federal Agency that maintains secure communication for Trump got hacked

By Deeba Ahmed The United States’ federal defense agency is responsible for ensuring safe communications with many high profile people including Trump. This is a post from HackRead.com Read the original post: Federal Agency that maintains secure communication for Trump got hacked...