CVE-2023-37405

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user...

CVE-2024-13390: Improper Neutralization of Input During Web Page Generation

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfolist' shortcode in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

The vulnerability of the software for deploying and managing cloud-based corporate systems based on IBM Cloud Pak System allows a hacker to expose protected information.

The vulnerability related to deploying and managing the IBM Cloud Pak System based on containers involves the disclosure of information during data transmission. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

CVE-2024-40620

CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the...

Cross-site Scripting (XSS)

Overview prosemirror-model is a ProseMirror's document model Affected versions of this package are vulnerable to Cross-site Scripting XSS due to serializeNodeInner and serializeMark functions that put a value from an attribute directly in an array used to describe a DOM structure and not fully...

The vulnerability of the Object-Store Profiler Command Handler component of the operating system in Clustered Data ONTAP storage systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Object-Store Profiler Command Handler component in the operating system of Clustered Data ONTAP storage systems relates to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

CVE-2024-4103: Cross-Site Request Forgery (CSRF)

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-27106: Missing Encryption of Sensitive Data

Vulnerable data in transit in GE HealthCare EchoPAC products...

General Electric Healthcare Imaging 安全漏洞

GE General Electric Healthcare Imaging is a medical imaging device from General Electric GE. A security vulnerability exists in General Electric Healthcare Imaging that stems from a flaw in data in transit...

CVE-2024-4104: Improper Neutralization of Input During Web Page Generation

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dbpid' parameter in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2024-3658 · Ge Healthcare · Ge Healthcare Echopac

Name of the Vulnerable Software and Affected Versions: GE HealthCare EchoPAC products affected versions not specified Description: The issue concerns vulnerable data in transit in GE HealthCare EchoPAC products, which is related to the lack of encryption measures. This could allow a remote attack...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

CVE-2023-6094

A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive...

OnCell G3150A-LTE Security Vulnerability

Moxa OnCell G3150A-LTE is a reliable and secure LTE gateway from Moxa China. A security vulnerability exists in OnCell G3150A-LTE v1.3 and earlier versions, which stems from the lack of protection of sensitive information during transmission, and an attacker may be able to obtain sensitive...

PT-2023-8290 · Moxa · Oncell G3150A-Lte Series

Name of the Vulnerable Software and Affected Versions: OnCell G3150A-LTE Series firmware versions prior to v1.3 Description: The issue is related to the transmission of data in an open manner, which could allow a remote attacker to obtain sensitive information. This could be achieved through...

Decoupling for Security

This is an excerpt from a longer paper. You can read the whole thing complete with sidebars and illustrations here. Our message is simple: it is possible to get the best of both worlds. We can and should get the benefits of the cloud while taking security back into our own hands. Here we outline ...

The vulnerability of the quality management software for automobile manufacturers, QMS Automotive, arises from the fact that confidential information is stored in unencrypted form in memory, allowing a hacker to obtain user account details.

The vulnerability of the quality management software for automobile manufacturers, QMS Automotive, relates to the storage of confidential information in unencrypted form in memory. Exploiting this vulnerability could allow a malicious actor to access user credentials remotely...

SICK FTMg 安全漏洞

SICK FTMg is a flow sensor from SICK. A security vulnerability exists in the SICK FTMg AIR FLOW SENSOR that arises from the inclusion of sensitive information in the source code, which could allow a remote attacker to analyze the source code to obtain information about a valid user name...

CVE-2021-21548

Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerabilit...

SAP Bank Account Management 信息泄露漏洞

SAP Bank Account Management is a bank account management system from SAP. An information disclosure vulnerability exists in the SAP Bank Account Management application, which stems from the fact that when a user clicks on a smart link to navigate to another application, personal data is displayed...