CVE-2022-27179

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised...

Cross site scripting

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised...

CVE-2022-27179 ICSA-22-104-03 Red Lion DA50N

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised...

CVE-2022-27179

CVE-2022-27179 is associated with Red Lion DA50N gateways, where an attacker with access to an exported configuration file may obtain stored credentials and access protected resources. The connected ICS advisory (CISA ICSA-22-104-03) ties this vulnerability to insecure credential handling (cited ...

Red Lion DA50N 安全漏洞

Red Lion DA50N is a series of secure edge network gateways from Red Lion, U.S.A. A security vulnerability exists in the Red Lion DA50N that could be exploited by an attacker to gain access to stored credentials and thereby gain access to protected resources...

The vulnerability of the Jenkins HashiCorp Vault’s software for storing API keys, tokens, and passwords arises from a flaw in its data protection mechanism. This flaw allows attackers to disclose the protected information.

The vulnerability of the Jenkins HashiCorp Vault’s software for storing API keys, tokens, and passwords is related to a flaw in the data protection mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to expose the protected information...

(0Day) Delta Industrial Automation DIAEnergie AM_Handler SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Industrial Automation DIAEnergie. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists with...

Jenkins Checkmarx Plugin Cross-Site Request Forgery Vulnerability

Jenkins plug-ins are plug-ins that provide appropriate functionality for Jenkins. Jenkins Checkmarx Plugin cross-site request forgery vulnerability. The vulnerability can be exploited by an attacker to connect to an attacker-specified web server via an attacker-specified credential ID to capture...

CVE-2021-34870

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.521.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue resul...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.521.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue resul...

WordPress Core 5.8.2 - (WP_Query) SQL Injection Vulnerability

Exploit Title: WordPress Core 5.8.2 - 'WPQuery' SQL Injection Exploit Author: Aryan Chehreghani Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download/releases Version: &nonce=a85a0c3bfa&...

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetData endpoint. The issue results from the lack of authorization prior to allowi...

NETGEAR 安全漏洞

NETGEAR is a router from the American company NETGEAR. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in NETGEAR routers that could be exploited by a network neighbor attacker to disclose sensitive information about...

CVE-2021-36309

Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks...

NETGEAR XR1000 UPnP SOAPAction Missing Authentication Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack ...

Netgear NETGEAR 访问控制错误漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. The NETGEAR XR1000 suffers from an access control error vulnerability that stems from a lack of authentication required for privileged...

CVE-2021-34560

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once...

PT-2021-20545 · Pepperl+Fuchs · Wirelesshart Gateway

Name of the Vulnerable Software and Affected Versions: PEPPERL+FUCHS WirelessHART-Gateway versions 3.0.9 and earlier Description: A form in the affected software contains a password field with autocomplete enabled, allowing stored credentials to be captured by an attacker who gains control over t...

CVE-2021-34560

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once...

Advantech iView NetworkServlet findUpdateDeviceListDetails SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. The issue results from the lack of proper validation o...