Schneider Electric PowerLogic Cleartext Transmission of Sensitive Information (CVE-2021-22703)

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 see notification for affected versions, that could cause disclosure of user credentials when a malicious actor intercepts HTT...

kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak

The Linux kernel's TCP source port generation algorithm in the TCP stack contains a flaw due to the small table perturb size. This flaw allows an attacker to positively distinguish a system among devices with identical hardware and software, which lasts until the device restarts. An attacker can...

[SECURITY] Fedora 35 Update: golang-github-tdewolff-minify-2.11.10-3.fc35

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

The vulnerability of Siemens’ software and hardware-based TCP services, which allows attackers to trigger service failures.

The vulnerability of Siemens’ software and hardware TCP services is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of TCP modules in the software utility for processing Rsyslog logs, which allows a hacker to execute arbitrary code.

The vulnerability of TCP modules in the Rsyslog log-processing software lies in the writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-40012

Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2021-40012

Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality...

Design/Logic Flaw

Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2021-40012

CVE-2021-40012 affects Huawei EMUI (notably EMUI 12.x) via the video framework where pointers are improperly used during data transmission, exposing confidentiality. Root cause: incorrect handling of pointers in the data transfer path within the video framework. Impact: information disclosure pot...

CVE-2021-40012

Vulnerability of pointers being incorrectly used during data transmission in the video framework. Successful exploitation of this vulnerability may affect confidentiality...

PT-2022-11134 · Huawei · Emui +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns the incorrect use of pointers during data transmission in the video framework, which may impact confidentiality upon successful exploitation. Recommendations: At the...

The vulnerability of the SEPCOS Single Package software for the Secheron SEPCOS control and protection relay allows a hacker to elevate their privileges to the level of a superuser.

The vulnerability of the SEPCOS Single Package control and protection relay software is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to superuser status through the open TCP port for SSH...

The vulnerability in the HTTP server of the microprogramming software for AutomationDirect C-More series of touchscreen HMI devices allows a hacker to disclose protected information.

The vulnerability of the HTTP server of the C-More EA9 HMI series of touchscreen software solutions is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that is protected by the system...

CVE-2022-30791

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected...

The vulnerability of the OAS Engine SecureAddUser function in the platform for data transmission between devices and applications allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the OAS Engine SecureAddUser function on the platform for data transfer between devices and applications is related to the lack of authentication checks for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized...

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transmission between devices and applications allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transfer between devices and applications in the OAS Platform is related to the lack of authentication for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to ga...

kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak

The Linux kernel's TCP source port generation algorithm in the TCP stack contains a flaw due to the small table perturb size. This flaw allows an attacker to positively distinguish a system among devices with identical hardware and software, which lasts until the device restarts. An attacker can...

Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive Information

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file com.opsgenie.integration.jenkins.OpsGenieNotifier.xml and in job config.xml files on the Jenkins controller as part of its configuration. Additionally, they are transmitted in plain text as part o...

CVE-2022-34801

Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2022-34804

CVE-2022-34804 affects Jenkins OpsGenie Plugin 1.9 and earlier. The vulnerability described across multiple sources states that API keys are transmitted in plain text via the global Jenkins configuration form and job configuration forms, potentially exposing them. It also notes that API keys are ...