CVE-2020-18406

CVE-2020-18406 affects cmseasy v7.0.0 (CMS). The root cause is that form data is not encrypted, allowing user credentials to be sent in clear text. Several sources corroborate the issue and describe the impact as credential exposure over potentially plaintext channels. Documented risk factors inc...

CVE-2020-18406

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to the transmission of data in an open manner, allows attackers to increase their privileges.

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protection against Internet attacks is related to the transmission of data in an open manner. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-34188

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests...

Researchers Expose New Severe Flaws in Wago and Schneider Electric OT Products

Three security vulnerabilities have been disclosed in operational technology OT products from Wago and Schneider Electric. The flaws, per Forescout, are part of a broader set of shortcomings collectively called OT:ICEFALL, which now comprises a total of 61 issues spanning 13 different vendors...

Synology Router Manager (SRM) 1.2.x Multiple Vulnerabilities (Synology-SA-20:14)

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer arises from the lack of protective measures for the SQL query structure, allowing attackers to enhance their privileges.

The vulnerability of the software for processing and transmitting confidential data in Progress MOVEit Transfer is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

PT-2023-22594 · 4D Server · 4D Server

Name of the Vulnerable Software and Affected Versions: 4D Server software versions v17 through v19 R7 Description: A broken authentication issue allows attackers to send crafted TCP packets containing requests to perform arbitrary actions. Recommendations: For versions v17 through v19 R7, update ...

The vulnerability of the microprogramming software of ABB Terra AC wallboxes—UL40, Terra AC wallbox 80A, Terra AC wallbox UL32A, Terra AC wallbox CE MID, Terra AC wallbox CE Juno, Terra AC wallbox CE PTB, Terra AC wallbox CE Symbiosis, and Terra AC wallbox JP—is related to the transmission of data in an open manner. This allows a intruder to access the configuration data.

The vulnerability of the microprogramming software of ABB Terra AC wallboxes—such as Terra AC wallbox UL40, Terra AC wallbox 80A, Terra AC wallbox UL32A, Terra AC wallbox CE MID, Terra AC wallbox CE Juno, Terra AC wallbox CE PTB, Terra AC wallbox CE Symbiosis, and Terra AC wallbox JP—is related t...

OWASP APIsec Top-10 2023 Is Here | API Security Newsletter

Welcome to our May API newsletter, recapping some of the events of last month. As the old proverb goes, April showers bring May flowers – and this means the bees at the Wallarm hive have been in full foraging mode and the honey is flowing: lots of updates & improvements to the platform, and much...

CVE-2022-41327

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

Design/Logic Flaw

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

CVE-2022-41327

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

CVE-2022-41327

CVE-2022-41327 affects Fortinet FortiOS (7.2.0–7.2.4, 7.0.0–7.0.8) and FortiProxy (7.2.0–7.2.1, 7.0.0–7.0.8). It is a cleartext transmission of sensitive information vulnerability that can allow an authenticated, readonly superadmin to capture other administrators’ cookies via diagnose CLI comman...

CVE-2022-41327

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

Read Only administrator can intercept sensitive data

...

Chrome Logger Information Disclosure

Chrome Logger is a Google Chrome extension used to debug server side applications in the Chrome console. By installing the extension in their Chrome browser and a server-side library on their application, developers can retrieve the configured debug information directly in Chrome. As Chrome Logge...

Atlas Copco Power Focus 6000

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Atlas Copco Equipment: Power Focus 6000 Vulnerabilities: Cleartext Storage of Sensitive Information, Small Space of Random Values, Cleartext Transmission of Sensitive Information 2. RISK EVALUATION...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-206)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-206 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

EulerOS Virtualization 2.11.1 : curl (EulerOS-SA-2023-2066)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when...