CVE-2022-22506

IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293...

Smart Helmets Flaw Exposed Millions to Risk of Hacking and Surveillance

By Deeba Ahmed According to cybersecurity firm Pen Test Partners, Livall’s smart helmets had an inherent flaw that could lead to… This is a post from HackRead.com Read the original post: Smart Helmets Flaw Exposed Millions to Risk of Hacking and Surveillance...

CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

Design/Logic Flaw

Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.getldapinfo in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity,...

CVE-2024-24760

mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container,...

PT-2024-20538 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow versions prior to 2024-01c Description: A security issue has been identified in mailcow, a dockerized email package. This issue potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even wh...

Mother of all Breaches may contain NEW breach data

On January 23, 2024, we reported on the discovery of billions of exposed records online, now commonly referred to as the “mother of all breaches” MOAB. Since then, the source of the dataset has been identified as data breach search engine Leak-Lookup. Prevention platform SpyCloud compared the MOA...

vantage6 has insecure SSH configuration for node and server containers

Impact Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive. We will probably opt to...

MAL-2024-933 Malicious code in iifl_express_middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bd6065d5aeb8d845fa2198e1ffedbb927895fbac183920ec87d85e89c79c03b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Kylin 安全漏洞

Apache Kylin is the United States Apache Apache Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache Kylin suffers from an information disclosu...

Dell NetWorker 安全漏洞

Dell NetWorker is an application from Dell USA Inc. Provides forum discussion features for Dell Inc. An information disclosure vulnerability exists in Dell NetWorker, which arises from the database storing plain text passwords in a temporary configuration file during backups, and can be exploited...

MAL-2024-843 Malicious code in wlwz-2312-7407 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5598f2500474143c1b6765ca2f10626af481f2562493214cc9504a92b497a5f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-648 Malicious code in wlwz-2312-5301 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86163aecf0ef7f4d9e376d7d04d9874fe1b30306d89b5a85b05c75740fb24a7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-366 Malicious code in wlwz-2312-2107 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4e0473238cfdc7e52ebe6ae11e6dc9575d8ca45278ee0fcea1fd6d19420a783 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-10089 · Drupal · Drupal Swift Mailer

Name of the Vulnerable Software and Affected Versions: Drupal Swift Mailer versions . Description: The issue is related to an Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer, which allows Resource Location Spoofing. This can be exploited by a remote attacker to perform...

Voltronic Power ViewPower Pro

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Voltronic Power Equipment: ViewPower Pro Vulnerabilities: Deserialization of Untrusted Data, Missing Authentication for Critical Function, Exposed Dangerous Method or Function, OS Command...

Axis Communications Multiple IP Cameras Exposed Insecure Interface (CVE-2018-10662)

An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

The vulnerability of the software for managing and controlling access to corporate resources and IBM Security Verify Governance applications lies in the use of pre-installed user accounts, which allows attackers to expose sensitive information that should be protected.

The vulnerability of the software for managing and controlling access to corporate resources and applications of IBM Security Verify Governance is related to the use of pre-installed user accounts. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

SolaX Pocket WiFi Security Vulnerability

SolaX Power SolaX Pocket WiFi is a portable WiFi from SolaX Power. A security vulnerability exists in SolaX Pocket WiFi version 3 through 3.001.02, which originates from an attacker being able to obtain a plaintext copy of the device's network configuration during device setup and reconfiguration...