CVE-2020-12036

CVE-2020-12036 affects Baxter PrismaFlex (all versions) and PrisMax (all versions prior to 3.x). The root cause is lack of data-in-transit encryption (no TLS/SSL) when these devices send treatment data to a PDMS or EMR, enabling an attacker with network access to observe sensitive data. The ICS a...

Baxter ExactaMix (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Baxter Equipment: Baxter ExactaMix EM 2400 & EM 1200 Vulnerabilities: Use of Hard-coded Password, Cleartext Transmission of Sensitive Data, Missing Encryption of Sensitive Data, Improper Access...

CVE-2020-2198

Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure...

The vulnerability of the Siemens SPPA-T3000 application server allows a hacker to gain access to confidential information.

The vulnerability of the Siemens SPPA-T3000 application server is related to the transmission of data in an open manner. Exploiting this vulnerability can allow attackers to access confidential information...

The vulnerability of the “password” function in the TriStation 1131 security logic analysis software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the “password” function in the TriStation 1131 security logic analysis software is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

CVE-2019-19741

Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service verifies the client's...

CVE-2020-8989

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. Fo...

Design/Logic Flaw

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. Fo...

CVE-2020-8989

The CVE-2020-8989 entry concerns the Voatz Android app (2020-01-01). The vulnerability is that the amount of data transmitted for a voter’s choice correlates with the metadata lengths across voting options, enabling an observer to infer a voter’s choice by sniffing network traffic. The root cause...

CVE-2020-8989

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. Fo...

Multiple Philips Products Encryption Issues Vulnerabilities

Philips Veradius Unity and others are a C-arm device for the medical industry from the European company Philips. An encryption issue vulnerability exists in the Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, which stems from the program's use of a weak encryption mechanism, and can ...

CVE-2019-16672

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sensitive Credentials data is transmitted in cleartext...

CVE-2019-12410

CVE-2019-12410 affects Apache Arrow 0.12.0–0.14.1, where memory for Arrow Arrays could be left uninitialized when reading RLE null data from Parquet. This impacts C++, Python, Ruby, and R implementations and could lead to leaking uninitialized memory if data is transmitted (e.g., Flight) or persi...

CVE-2016-10906

A use-after-free flaw was found in the Ethernet subsystem of the Linux kernel. A race condition was observed while a data transmission from a buffer occurred when the buffer was already freed causing a use-after-free problem. Mitigation Mitigation for this issue is either not available or the...

Default credentials

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...

Foxit Reader 9.0 < 9.6.0.25114 Security Bypass Vulnerability

According to its version, the Foxit Reader application installed on the remote Windows host is prior to 9.6.0.25114. It is, therefore affected by a security bypass vulnerability. Safe reading mode may be disabled when users update an existing installation of Foxit Reader from within the...

Design/Logic Flaw

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

Design/Logic Flaw

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK...

CVE-2019-13266

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

Design/Logic Flaw

Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. Successful exploitation could lead to information leakage...