CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...

Netgear R6850 安全漏洞

The Netgear R6850 is a wireless router from NETGEAR. The Netgear R6850 suffers from an information disclosure vulnerability that originates from insufficient protection of sensitive information in currentsetting.htm, which can be exploited by an attacker to obtain sensitive information...

Insecure Temporary File Usage

wixtoolset.sdk,wix is vulnerable to Insecure Temporary File Usage. The vulnerability is due to insufficient protection against low privilege users tampering with installation binaries, which can result in privilege escalation...

IBM Host Access Transformation Services 安全漏洞

IBM Host Access Transformation Services is a software solution from International Business Machines IBM. IBM Host Access Transformation Services suffers from an insufficiently protected credentials vulnerability that arises from storing user credentials in plaintext, which can be exploited by an...

Command injection

Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...

CVE-2024-21815

Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...

CVE-2022-34311 IBM CICS TX session fixation

IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials. IBM X-Force ID: 229446...

CVE-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CVE-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

PT-2024-2069 · Nginx +1 · Nginx +1

Name of the Vulnerable Software and Affected Versions: vantage6-UI versions prior to 4.2.0 Description: The issue is related to insufficient protection of service data in the vantage6-UI interface, which can allow a remote attacker to gain unauthorized access to protected information. The docker...

CVE-2023-29055 Apache Kylin: Insufficiently protected credentials in config file

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP or other plain text protocol, it is possible for network sniffers to hijack the HTTP...

CVE-2023-29447 Insufficiently Protected Credentials in PTC's Kepware KEPServerEX

An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication...

CVE-2023-43089

Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources...

Design/Logic Flaw

Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources...

CVE-2023-43089

Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to unauthorized access to resources...

CVE-2023-43089

Dell Rugged Control Center prior to 4.7 is affected by insufficient protection of the Policy folder, allowing a local standard user to modify the policy file and potentially access resources. Affected product: Dell Rugged Control Center (Windows). Root cause: inadequate protection of the Policy f...

ROS-20231115-04

Visual Studio Coden source code editor vulnerability related to improper control of code generation. code generation. Exploitation of the vulnerability may allow an attacker to execute arbitrary code Visual Studio Code source code editor vulnerability is related to insufficient protection of...

ROS-20231110-03

Vulnerability of the DirSync catlog synchronization mechanism of the Samba networking software package is related to insufficient protection of service data. Exploitation of the vulnerability could allow an attacker, acting remotely, gain unauthorized access to protected information and increase...

Nokia G-040W-Q Security Vulnerability

The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which arises from insufficient measures to prevent multiple failed authentication attempts...

Microsoft Visual Studio Information Disclosure

The vulnerability of the Microsoft Visual Studio software relates to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to disclose confidential information...