5773 matches found
CVE-2024-30142
HCL BigFix Compliance is affected by a missing secure flag on a cookie, enabling cookie theft via XSS and potentially unauthorized access or cookies transmitted over unencrypted channels. The CVE refers to vulnerability in product HCL BigFix Compliance (reported as 2024-30142) and is corroborated...
CVE-2024-20457
A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of unencrypted credentia...
CVE-2024-20457
A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of unencrypted credentia...
CVE-2024-20457 Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability
A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of unencrypted credentia...
The vulnerability of the HTTP protocol implementation in DynDNS and NO-IP microprogramming-based IP camera software from Hikvision allows attackers to carry out “man-in-the-middle” attacks.
The vulnerability of the HTTP protocol implementation in DynDNS and NO-IP microprogramming-based IP camera software from Hikvision involves the transmission of confidential information in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to carry out a...
CVE-2023-29114 Unauthorized System Log Disclosure in Enel X JuiceBox
System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: • Wi-Fi access point credentials to which the EV charger can connect. • APN web address and credentials. • IPSEC credentials...
CVE-2023-29114
The CVE-2023-29114 entry concerns Enel X Waybox (JuiceBox) where a lack of access control lets attackers read system logs via the web management interface. The exposed logs contain sensitive credentials and configuration data, including Wi‑Fi credentials, APN web address/credentials, IPsec creden...
[SECURITY] Fedora 41 Update: krb5-1.21.3-3.fc41
Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...
JVN#11779839: Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials
Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP. The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware versions of...
PT-2024-9153 · Nextcloud +2 · Nextcloud Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.12 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 30.0.2 Description: The issue concerns the storage of user passwords in unencrypted form in session data under certain...
CISA Warns of Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance
The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning that it has observed threat actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Local Traffic Manager LTM module to conduct reconnaissance of target networks. It said the module is being used to...
Gradio 安全漏洞
Gradio, an open source Python library open sourced by Hugging Face, is a method for demonstrating machine learning models through a friendly web interface. Gradio has a security vulnerability that stems from HTTPS not being enforced over a connection. An attacker exploiting this vulnerability cou...
CentOS 7 : thunderbird (RHSA-2021:2263)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2263 advisory. - OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The...
Cross Site Scripting(XSS)
OpenC3 COSMOS is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to the insecure storage of user passwords in an unencrypted format within the LocalStorage of a web browser, allows an attacker to execute malicious scripts in a user's browser...
CVE-2024-41589
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests...
CVE-2024-41589
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests...
Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks
Google has revealed the various security guardrails that have been incorporated into its latest Pixel devices to counter the rising threat posed by baseband security attacks. The cellular baseband i.e., modem refers to a processor on the device that's responsible for handling all connectivity, su...
CVE-2024-41589
DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests...
DrayTek Vigor 3910 安全漏洞
The DrayTek Vigor 3910 is a high performance router for enterprise networks from DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which originates from unencrypted HTTP for authentication requests...