CVE-2024-5631

Longse NVR Network Video Recorder model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the...

CVE-2024-5631

Summary (verified by provided sources): CVE-2024-5631 affects Longse LBH30FE200W cameras and related devices (e.g., NVR3608PGE2W family). The issue enables credential exposure because login/password are transmitted to a remote control service without encryption when a user changes their password,...

Longse NVR Security Vulnerability

Longse NVR is a series of network video recorders from China-based Longse Technology Longse. A security vulnerability exists in the Longse NVR that stems from transmitting a user's login and password to a remote control service without the use of any encryption, allowing an attacker to eavesdrop ...

SAP GUI Information Disclosure Vulnerability

SAP GUI is an application from SAP, a German company. graphical user interface for SAP systems. An information disclosure vulnerability exists in SAP GUI for Windows, which arises from the fact that under certain conditions, memory contains passwords used to log on to the SAP system, which could...

The vulnerability of the image.bin file in the microprogramming software of the Ethernet serial interface converter Industrial Transformer Westermo EDW-100 allows a hacker to disclose user name and password information for the root account.

The vulnerability of the image.bin file in the microprogramming software of the Ethernet serial interface converter Westermo EDW-100 is related to the use of rigidly encrypted login credentials. Exploiting this vulnerability can allow a malicious actor to obtain information such as the username a...

PT-2024-6690 · Advantech · Adam-5630

Name of the Vulnerable Software and Affected Versions: Advantech ADAM-5630 affected versions not specified Description: The issue is related to the transmission of user credentials in plain text between the device and the user source device during the login process. This is due to the use of weak...

CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Vulnerabilities in employee management system could lead to remote code execution, login credential theft

Cisco Talos Vulnerability Research team has disclosed more than a dozen vulnerabilities over the past three weeks, five in a device that allows employees to check in and out of their shifts, and another that exists in an open-source library used in medical device imaging files. The Peplink Smart...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls in Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to insufficient access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

SQL Injection

mautic/core is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of user-supplied input within the Reports bundle. An attacker can retrieve and alter sensitive data, including login credentials, and depending on database permissions, manipulate file systems by injecti...

CVE-2024-30406

A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials. Th...

CVE-2024-1139

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

The vulnerability of the microprogrammed software of the hybrid digital video recorder Hitron Systems DVR LGUVR-4H, related to the use of default login credentials, allows a violator to trigger a service failure.

The vulnerability of the microprogramming software of the hybrid digital video recorder Hitron Systems DVR LGUVR-4H is related to the use of default login credentials. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by using the default network identifier...

CVE-2024-1623

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not...

CVE-2024-1623 Insufficient session timeout vulnerability in Sagemcom router

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not...

CVE-2024-1827

A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librarian/user/teacher/login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely...

Thousands of Stolen AnyDesk Login Credentials Sold on Dark Web

By Waqas It's crucial to note that this sale of compromised AnyDesk accounts isn't connected to the security breach incident disclosed by the company on February 2, 2024. This is a post from HackRead.com Read the original post: Thousands of Stolen AnyDesk Login Credentials Sold on Dark Web...

QR Code Phishing Soars 587%: Users Falling Victim to Social Engineering Scams

By Deeba Ahmed QR Code Phishing has surged by a staggering 587%, with scammers exploiting it to steal login credentials and deploy malware. This is a post from HackRead.com Read the original post: QR Code Phishing Soars 587%: Users Falling Victim to Social Engineering Scams...