CVE-2022-36360

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker t...

PT-2022-24870

Name of the Vulnerable Software and Affected Versions tiny-csrf versions prior to 1.1.0 Description The issue concerns the transmission of CSRF tokens in the clear due to unencrypted cookies in versions prior to 1.1.0. This allows malicious attackers to read the tokens. The problem has been...

tiny-csrf 安全漏洞

tiny-csrf is a small csrf library by Vincent Alexander Saulys personal developer. It is intended to replace the work done by csurf before it was removed. A security vulnerability exists in versions of tiny-csrf prior to 1.1.0, which stems from the fact that cookies are not encrypted, and thus CSR...

CVE-2022-39287

tiny-csrf is a Node.js cross site request forgery CSRF protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit "8eead6d" and the patch with be included in version 1.1.0. Users are...

Valmet System 2019 Unencrypted Storage

The vulnerability of the Valmet System 2019 software suite Metso DNA is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information...

Zyxel Cloud CNM SecuManager Full Access

The vulnerability of the /opt/axess/etc/default/axess software for network device centralized management in Zyxel CloudCNM SecuManager lies in the unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor to gain full access to network devices remotely...

Linux kernel Confidential Data Access

The vulnerability of the Linux operating system’s kernel is related to the transfer of protected information in unencrypted form. Exploiting this vulnerability allows an attacker to gain access to confidential data...

Security Bulletin: Multiple vulnerabilities in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite (CVE-2013-2953, CVE-2013-2954, CVE-2013-2955, CVE-2013-2956, CVE-2013-2957, CVE-2013-2959)

Abstract Multiple vulnerabilities have been identified in the Optim E-Business Console making the product vulnerable to phishing attacks, the interception of credentials and the bypass of login entirely. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2953 DESCRIPTION: Use of MD5 as SSL Certifica...

Security Bulletin: IBM Tivoli Directory Server use of NULL ciphers in default Transport Layer Security configuration would result in unencrypted communications (CVE-2012-0726)

Abstract IBM Tivoli Directory Server TDS enables NULL-MD5 and NULL-SHA ciphers in the default Transport Layer Security TLS configuration. Use of either of these ciphers would result in unencrypted communications. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0726 DESCRIPTION: In the default TDS...

Security Bulletin: IBM Sterling Connect:Direct for OpenVMS. Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. (CVE-2013-4035)

Abstract Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. Content VULNERABILITY DETAILS: CVEID: CVE-2013-4035 DESCRIPTION: When Connect:Direct for OpenVMS is the server in a TCP/IP session, and the client requests an unencrypted session, C:...

Morgan Stanley's years-long "extensive failure" to protect customer data ends in huge fine

On Tuesday, the Securities and Exchange Commission SEC charged financial company Morgan Stanley a $35M fine for "the firm's extensive failures, over five years, to protect the personal identifying information, or PII, of approximately 15 million customers. The company agreed to settle the penalty...

Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionall...

GHSA-J7XV-FC46-HGPG Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionall...

PT-2022-6158 · Dell · Dell Geodrive

Name of the Vulnerable Software and Affected Versions: Dell GeoDrive versions 2.1 through 2.2 Description: The issue is related to an information disclosure vulnerability. It allows an authenticated non-admin user to potentially gain access to sensitive information. The vulnerability is also...

CVE-2022-41255

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2022-41247

Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-41255

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2022-41247

Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...