PT-2024-5700

Name of the Vulnerable Software and Affected Versions .NET and Visual Studio affected versions not specified Description The issue is related to the transmission of credentials in unencrypted form, which could allow a remote attacker to disclose protected information. Recommendations At the momen...

PT-2024-5714

Name of the Vulnerable Software and Affected Versions .NET and Visual Studio affected versions not specified Description The issue is related to a denial of service vulnerability. It involves the transmission of credentials in unencrypted form. An attacker, acting remotely, can exploit this issue...

exacqVision Web Service HTTPS Unauthorized Access

The vulnerability of the HTTPS implementation of the exacqVision Web Service in the video surveillance system exacqVision relates to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected...

PT-2024-6530 · Cisco · Cisco Duo Epic For Hyperdrive

Name of the Vulnerable Software and Affected Versions: Cisco Duo Epic for Hyperdrive affected versions not specified Description: The issue is related to insufficient protection of service data, which could allow an authenticated, local attacker to view sensitive information in cleartext on an...

Fedora: Security Advisory (FEDORA-2024-1f68985052)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Korenix JetPort 5601 操作系统命令注入漏洞

The Korenix JetPort 5601 is an intelligent serial device server from Korenix. A security vulnerability exists in Korenix JetPort 5601 version 1.2 and earlier, which stems from the lack of encryption of sensitive data in the resulting eavesdropping...

PT-2024-5341 · Omnivise · Omnivise T3000 Terminal Server +7

Name of the Vulnerable Software and Affected Versions: Omnivise T3000 Application Server R9.2 All versions Omnivise T3000 Domain Controller R9.2 All versions Omnivise T3000 Network Intrusion Detection System NIDS R9.2 All versions Omnivise T3000 Product Data Management PDM R9.2 All versions...

Omnivise T3000 Disclosure Privilege

The vulnerabilities of the Omnivise T3000 Application Server, Omnivise T3000 Domain Controller, Omnivise T3000 Network Intrusion Detection System NIDS, Omnivise T3000 Product Data Management PDM, Omnivise T3000 Security Server, Omnivise T3000 Terminal Server, Omnivise T3000 Thin Client, and...

Missing Encryption Of Sensitive Data

Elasticsearch is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to the elasticsearch-certutil CLI tool storing generated private keys unencrypted on disk when creating Certificate Signing Requests, even if the --pass parameter is used...

IBM QRadar Suite Security Analytics Information Disclosure

The vulnerabilities of event monitoring platforms, threat detection systems, and security analytics tools from IBM QRadar Suite and IBM Cloud Pak for Security are related to the storage of protected information in unencrypted form. Exploiting these vulnerabilities can allow attackers to gain...

IBM Datacap Navigator Unencrypted Storage

The vulnerability of the IBM Datacap Navigator web client software for document collection and processing involves the unencrypted storage of critical information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data...

Elasticsearch stores private key on disk unencrypted

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

GHSA-5V8F-XX9M-WJ44 Elasticsearch stores private key on disk unencrypted

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

UBUNTU-CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34372)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from unencrypted storage of WPA/WPS credentials in the router firmware/database. An attacker can exploit this vulnerability to obtain...

GLPI Improper Input Cancellation Unauthorized Access

The vulnerability of the GLPI request and incident handling system lies in the fact that the registration key is not properly encrypted on the configuration page for the registration key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...