PT-2024-5700

Name of the Vulnerable Software and Affected Versions .NET and Visual Studio affected versions not specified Description The issue is related to the transmission of credentials in unencrypted form, which could allow a remote attacker to disclose protected information. Recommendations At the momen...

PT-2024-5714

Name of the Vulnerable Software and Affected Versions .NET and Visual Studio affected versions not specified Description The issue is related to a denial of service vulnerability. It involves the transmission of credentials in unencrypted form. An attacker, acting remotely, can exploit this issue...

The vulnerability of the HTTPS implementation of the exacqVision Web Service interface of the video surveillance system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the HTTPS implementation of the exacqVision Web Service in the video surveillance system exacqVision relates to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected...

PT-2024-6530 · Cisco · Cisco Duo Epic For Hyperdrive

Name of the Vulnerable Software and Affected Versions: Cisco Duo Epic for Hyperdrive affected versions not specified Description: The issue is related to insufficient protection of service data, which could allow an authenticated, local attacker to view sensitive information in cleartext on an...

Fedora: Security Advisory (FEDORA-2024-1f68985052)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Korenix JetPort 5601 操作系统命令注入漏洞

The Korenix JetPort 5601 is an intelligent serial device server from Korenix. A security vulnerability exists in Korenix JetPort 5601 version 1.2 and earlier, which stems from the lack of encryption of sensitive data in the resulting eavesdropping...

PT-2024-5341 · Omnivise · Omnivise T3000 Terminal Server +7

Name of the Vulnerable Software and Affected Versions: Omnivise T3000 Application Server R9.2 All versions Omnivise T3000 Domain Controller R9.2 All versions Omnivise T3000 Network Intrusion Detection System NIDS R9.2 All versions Omnivise T3000 Product Data Management PDM R9.2 All versions...

The vulnerabilities of the components such as Omnivise T3000 Application Server, Omnivise T3000 Domain Controller, Omnivise T3000 Network Intrusion Detection System (NIDS), Omnivise T3000 Product Data Management (PDM), Omnivise T3000 Security Server, Omnivise T3000 Terminal Server, Omnivise T3000 Thin Client, and Omnivise T3000 Whitelisting Server, along with their software-defined hardware platforms for process management and monitoring in the Siemens Omnivise T3000 system, allow attackers to disclose protected information and enhance their privileges.

The vulnerabilities of the Omnivise T3000 Application Server, Omnivise T3000 Domain Controller, Omnivise T3000 Network Intrusion Detection System NIDS, Omnivise T3000 Product Data Management PDM, Omnivise T3000 Security Server, Omnivise T3000 Terminal Server, Omnivise T3000 Thin Client, and...

Missing Encryption Of Sensitive Data

Elasticsearch is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to the elasticsearch-certutil CLI tool storing generated private keys unencrypted on disk when creating Certificate Signing Requests, even if the --pass parameter is used...

The vulnerability of platformes for monitoring events, detecting threats, and performing security analytics in IBM QRadar Suite and IBM Cloud Pak for Security lies in the fact that protected information is stored in unencrypted form, allowing attackers to gain unauthorized access to this protected information.

The vulnerabilities of event monitoring platforms, threat detection systems, and security analytics tools from IBM QRadar Suite and IBM Cloud Pak for Security are related to the storage of protected information in unencrypted form. Exploiting these vulnerabilities can allow attackers to gain...

The vulnerability in the web-based client of IBM Datacap Navigator software for document collection and processing involves the unencrypted storage of critical information, allowing an intruder to gain unauthorized access to protected data.

The vulnerability of the IBM Datacap Navigator web client software for document collection and processing involves the unencrypted storage of critical information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data...

GHSA-5V8F-XX9M-WJ44 Elasticsearch stores private key on disk unencrypted

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

Elasticsearch stores private key on disk unencrypted

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

UBUNTU-CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34372)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from unencrypted storage of WPA/WPS credentials in the router firmware/database. An attacker can exploit this vulnerability to obtain...

The vulnerability of the GLPI system’s handling of requests and incidents is related to improper cancellation of input data during the generation of web pages. This allows a malicious user to gain unauthorized access to GLPI administrator’s cookie files.

The vulnerability of the GLPI request and incident handling system lies in the fact that the registration key is not properly encrypted on the configuration page for the registration key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...