Tata Sonata Smart SF Rush Data Forgery Issue Vulnerability

Tata Sonata Smart SF Rush is a smart bracelet product from Tata India. The product supports features like calorie counting and sleep tracking. A security vulnerability exists in Tata Sonata Smart SF Rush version 1.12, which originates from an unencrypted over-the-air transmission and fails to...

CVE-2020-11539

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing mode 0 Bluetooth LE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any...

PT-2020-12676

Name of the Vulnerable Software and Affected Versions Tata Sonata Smart SF Rush version 1.12 Description An issue has been identified where the smart band operates with no pairing, utilizing mode 0 Bluetooth LE security level. This results in unencrypted data transmission over the air. Furthermor...

CVE-2020-11539: Missing Authentication for Critical Function

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing mode 0 Bluetooth LE security level The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any...

Validation Bypass

github.com/pion/dtls is vulnerable to validation bypass . The function handleIncomingPacket is not validating the incoming application data with epoch 0, accepting a remote user provided unencrypted or unauthenticated data after handshake completion...

Pion DTLS Authorization Issues Vulnerability

Pion DTLS is a Go-based implementation of DTLS Packet Transport Layer Security Protocol. An authorization issue vulnerability exists in Pion DTLS versions prior to 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary unencrypted data after the handshake completes...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

Design/Logic Flaw

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

PT-2020-10759

Name of the Vulnerable Software and Affected Versions Pion DTLS versions prior to 1.5.2 Description The issue allows remote attackers to inject arbitrary unencrypted data after handshake completion due to a lack of check for application data with epoch 0 in the handleIncomingPacket function. This...

CVE-2019-20786: Improper Authentication

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

CVE-2020-2177

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2177

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-11826

Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a database without encryption and an attacker can read the password-protected notes without having the password. Notes are stored in the ZENTITY...

Design/Logic Flaw

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2177

Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

CVE-2020-2177

CVE-2020-2177 affects the Jenkins Copr Plugin (versions 0.3 and earlier). The vulnerability stems from credentials being stored unencrypted in job config.xml files on the Jenkins master, enabling disclosure to users with Extended Read permissions or anyone with access to the master filesystem. Ex...

PT-2020-21436

Name of the Vulnerable Software and Affected Versions https-proxy-agent versions prior to 2.2.3 Description The issue allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials, by failing to enforce TLS ...

CVE-2018-6402

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby...

CVE-2018-6402

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby...