CVE-2024-21589 Paragon Active Assurance Control Center: Information disclosure vulnerability

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0...

IBM Security Access Manager Appliance Security Vulnerability

IBM Security Access Manager Appliance ISAM Appliance is a network appliance-based security solution from International Business Machines IBM. The product is primarily used for access control and Web-based threat protection, providing system performance monitoring, log analysis and diagnostics. A...

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB...

CVE-2023-47213

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. ...

CVE-2023-47213

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. ...

CVE-2023-47213

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. ...

CVE-2023-47213

First Corporation’s DVRs have a hard-coded password, enabling remote, unauthenticated access to rewrite or obtain device configuration. Affected models include CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB; updates are available only for Late models. For other products, apply t...

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB...

CVE-2023-47674

CVE-2023-47674 describes a missing authentication for a critical function in First Corporation’s DVRs, enabling a remote, unauthenticated attacker to rewrite or retrieve device configuration. Public details confirm affected models: late-model CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, an...

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB...

PT-2023-30560 · First · Dvrs

Name of the Vulnerable Software and Affected Versions: First Corporation's DVRs affected versions not specified Description: A missing authentication for critical function issue allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device...

CVE-2023-41721

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

CVE-2023-25522

NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in an unexpected format. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering...

Jenkins: Information disclosure through error stack traces related to agents

A flaw was found in Jenkins. The affected version of Jenkins prints an error stack trace on agent-related pages when agent connections are broken. This stack trace may contain information about Jenkins configuration that is otherwise inaccessible to attackers...

GeoNode 信息泄露漏洞

GeoNode is an open source platform that facilitates the creation, sharing and collaborative use of geospatial data. An information disclosure vulnerability exists in GeoNode versions prior to 2.20.7, which stems from an anonymous user being able to obtain sensitive configuration-related informati...

Atlassian Crowd < 3.6.0 Improper Authorization Via ATST Plugin

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to version 3.6.0. It is, therefore, shipped with a vulnerable version of the Atlassian Troubleshooting and Support plugin ATST, which permitted unprivileged users to initialte log...

K23024812: BIG-IP APM vulnerability CVE-2018-5544

Security Advisory Description When the BIG-IP APM system renders certain pages with a logon agent or a confirm box, the system may disclose configuration information such as partition and agent names via URI parameters. CVE-2018-5544 Impact This vulnerability allows unauthorized disclosure of...

SUSE CVE-2010-4080

The sndhdsphwdepioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRVHDSPIOCTLGETCONFIGINFO ioctl call...

Command injection

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An...

CVE-2022-31769

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against the system. IBM X-Force ID: 228219...