CVE-2022-32506: Improper Physical Access Control

An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to the circuit board could use the SWD debug features to control the execution of code on the processor and debug the firmware, as well as read or alter the content of the internal and external flash...

Nuki Bridge security vulnerabilities

Nuki Bridge is a smart lock control software from Nuki. A security vulnerability exists in Nuki Bridge v1.x prior to v1.22.0 and v2.x prior to v2.13.2, and Nuki Keypad v1.9.2 prior to v1.9.2, which stems from an attacker being able to use debugging functionality to control the execution of code o...

PT-2024-4509

Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V3.0.1.1 Description The issue is related to the presence of undocumented configuration commands in the software. Exploitation of this issue could allow an attacker to gain information about the...

CVE-2024-34353: Insertion of Sensitive Information into Log File

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides ...

Siemens’ various products have security vulnerabilities

SIMATIC RTLS Locating Manager is used to configure, operate and maintain the SIMATIC RTLS unit, a real-time wireless positioning system that provides locating solutions. A hidden function vulnerability exists in Siemens SIMATIC RTLS Locating Manager due to an affected application containing hidde...

CVE-2024-33583: Hidden Functionality

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

GHSA-9GGC-845V-GCGV matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

Introduction In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assign...

CVE-2024-34353

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side "key backup" stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provide...

CVE-2024-34353 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides ...

PT-2024-28075

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6 Description The issue arises from the reinitialization of the whole EST structure, which resets the mutex lock embedded in the EST structure and triggers a warning. To address this, the lock is moved to...

PT-2024-25810 · Tracing +1 · Tracing +1

Name of the Vulnerable Software and Affected Versions: matrix-sdk-crypto version 0.7.0 matrix-sdk-crypto versions prior to 0.7.1 Description: The issue concerns a logic bug in the matrix-sdk-crypto crate, which is part of the Matrix Rust SDK project. This bug causes the private part of the backup...

RHEL 7 : ovirt-engine (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ovirt-engine: webadmin log out must logout all sessions CVE-2016-6338 - ovirt-engine: API exposes power...

RHEL 7 : docker (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - docker: IPv6 router advertisements allow for MitM attacks CVE-2020-13401 - docker: cli leaks private...

RHEL 8 : nodejs-debug (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - nodejs-debug: Regular expression Denial of Service CVE-2017-16137 Note that Nessus has not tested for this issue bu...

CVE-2022-32506

Nuki Home Solutions devices are affected by a vulnerability where an attacker with physical access to the circuit board can exploit SWD debug features . This allows the attacker to control code execution on the processor, debug the firmware, and read or alter the content of both internal and exte...

CVE-2024-34565

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10...

CVE-2024-34565 WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10...

CVE-2024-34565

CVE-2024-34565 is a Cross-Site Scripting (Stored XSS) vulnerability in the WordPress Debug Info plugin. The issue is caused by improper input neutralization during web page generation and affects Debug Info versions up to 1.3.10 (n/a through 1.3.10). Exploitation details, affected environments, a...

CVE-2024-34565 WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10...

WordPress Plugin Debug Info: Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin Debug Info A cross-site scripting...