Mail.ru: Full Account Takeover Student Account In https://********.ru/signin/main/student/email

3rd party project with Mail.ru investitions had no sufficient protection against authentication code bruteforce...

CVE-2020-28219

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1 and EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551....

Improper Access Control

chromium is vulnerable to improper access control. The vulnerability exists due to insufficient protection of permission UI in WebAPKs in Google Chrome, allowing an attacker who convinced the user to install a malicious application to access web APIs via a crafted APK...

The vulnerability of the Intel QuickAssist Technology implementation lies in the insufficient protection of registration data, which allows attackers to enhance their privileges.

The vulnerability of the Intel QuickAssist Technology implementation is related to insufficient protection of registration data. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2020-26079 Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability

A vulnerability in the web UI of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by...

CVE-2020-8152

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on...

Cisco FXOS Cross-Site Request Forgery Vulnerability

Cisco FXOS Software is a set of firewall software from Cisco that runs in Cisco security appliances. Cisco FXOS suffers from a cross-site request forgery vulnerability that stems from insufficient CSRF protection for the FCM interface. An attacker could exploit this vulnerability to conduct a...

Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the...

PT-2020-4427 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is related to insufficient protection of values passed to a script that executes during device startup, allowing an authenticated, local attacker with privileged EXE...

Design/Logic Flaw

Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding wires which have insufficient physical protection...

CVE-2020-8210

Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account...

Design/Logic Flaw

Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account...

The vulnerability of the parse_query method (class-wp-query.php) in the WordPress content management system allows a hacker to access confidential data.

The vulnerability of the parsequery method class-wp-query.php in the WordPress content management system is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

The vulnerability in the web interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) allows a perpetrator to carry out cross-site scenario attacks.

The vulnerability of the Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME web interfaces is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

Cross site request forgery (csrf)

SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site...

CVE-2020-8487

Insufficient protection of the inter-process communication functions in ABB System 800xA Base all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...

The vulnerability of the mod_auth_digest component in the Apache HTTP Server allows a hacker to gain unauthorized access to confidential information or execute arbitrary code.

The vulnerability of the modauthdigest component in the Apache HTTP Server is related to insufficient protection of web pages. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information or execute arbitrary code...

CVE-2020-3114 Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based...