Jenkins Vmware vRealize CodeStream 插件安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Vmware vRealize CodeStream Plugin...

Design/Logic Flaw

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43052

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719 Unauthorized forwarding of confidential headers in fluture-node

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

Fluture Node 输入验证错误漏洞

Fluture Node is a Fp style Http and streaming processing tool based on Fluture. Fluture Node suffers from a security vulnerability that stems from the fact that if the target server redirects a request to a third-party domain name server, the header will be included in subsequent requests and...

CVE-2022-26157

An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. The ASP.NETSessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels...

CVE-2022-26157

An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. The ASP.NETSessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels...

CVE-2022-26157

An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. The ASP.NETSessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels...

Cherwell Service Management 信息泄露漏洞

Cherwell Service Management is flexible, feature-rich ITSM software that is easy to use, configure, and maintain. An information disclosure vulnerability exists in Cherwell Service Management that stems from the product not effectively protecting the ASP.NETSessionid cookie. The vulnerability can...

PT-2022-17700 · Cherwell · Cherwell Service Management

Name of the Vulnerable Software and Affected Versions: Cherwell Service Management version 10.2.3 Description: An issue was discovered in the web application where the ASP.NET Sessionid cookie is not protected by the Secure flag, making it prone to interception by an attacker if traffic is sent...

Visual Voice Mail (VVM) services transmit unencrypted credentials via SMS

Overview Visual Voice Mail VVM services transmit unencrypted credentials via SMS. An attacker with the ability to read SMS messages can obtain VVM IMAP credentials and gain access to VVM data. Description VVM is specified by Open Mobile Terminal Platform-OMPT and is implemented with SMS and IMAP...

OpenAPI Unencrypted Traffic Allowed

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods. As for web applications, allowing unencrypted protocols to acce...

Ubuntu: Security Advisory (USN-5286-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...

GHSA-76WF-9VGP-PJ7W Duplicate Advisory: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6jvc-q2x7-pchv. This link is maintained to preserve external references. Original Description Summary The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker...

PT-2022-17545 · Amazon Web Services · Aws S3 Crypto Sdk

Name of the Vulnerable Software and Affected Versions: AWS S3 Crypto SDK affected versions not specified Description: The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is...

Buffer overflow

On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the boot header stored on an SD card so that a secure image...

GHSA-2VXM-VP4C-FJFW Authentication Bypass in Apache Cassandra

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internodeencryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despit...

EcoStruxure Geo SCADA Expert 加密问题漏洞

EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable Supervisory Control and Data Acquisition SCADA Software A security vulnerability exists in EcoStruxure Geo SCADA Expert that stems from the fact that communication with the server may not be encrypted when using an outdated...

The vulnerability of IP-Cisco IP Phone microprogramming software, related to the unencrypted storage of confidential information, allows attackers to gain unauthorized access to protected information.

The vulnerability of IP-Cisco IP phones related to microprogramming software involves the unencrypted storage of confidential information. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...