PT-2023-23735 · Ibm · Ibm Sterling Secure Proxy +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy and IBM Sterling External Authentication Server versions 6.0.3 through 6.1.0 Description: The issue allows a local user with container access to read user credentials stored in plain clear text. Recommendations: For...

U.S. Dept Of Defense: [██████] Reflected XSS via Keycloak on ██████

A cross-site scripting XSS vulnerability was discovered in Keycloak 8.0 and earlier versions. This vulnerability allowed an attacker to execute arbitrary script and potentially steal authentication credentials. The vulnerability was due to a lack of input validation, which allowed an attacker to...

Input validation

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to insufficient input validation of user-supplied CLI arguments. An...

SAP BusinessObjects Business Intelligence Information Disclosure Vulnerability

SAP BusinessObjects Business IntelligenceSuite is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics and data visualization. An information disclosure vulnerability exists in SAP BusinessObjects...

CVE-2023-4276

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

SAP BusinessObjects Business Intelligence Platform Information Disclosure (3312586)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is vulnerable to information disclosure. If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, whoch could lead to an attacker...

Design/Logic Flaw

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

CVE-2023-39440 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

CVE-2023-39440 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a successful attack, the attacker needs to...

CVE-2023-39440

CVE-2023-39440 (SAP BusinessObjects BI Platform Information Disclosure) Affected product: SAP BusinessObjects Business Intelligence Platform (version 420). Description in provided sources: when a user logs in to a specific program under certain conditions, memory may not be cleared properly, pote...

SAP BusinessObjects Business Intelligence 信息泄露漏洞

SAP BusinessObjects Business IntelligenceSuite is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics and data visualization. An information disclosure vulnerability exists in SAP BusinessObjects...

Authorization

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP

Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...

CVE-2023-21408

CVE-2023-21408: The description indicates an issue of insufficient file permissions that could let unprivileged users access unencrypted credentials used by the integration interface to third-party systems. The provided metrics show a high to critical impact (confidentiality, integrity, availabil...

ZKTeco BioTime Security Breach

ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime v8.5.5 that could allow an unauthenticated attacker to read sensitive backup files and access sensitive information such as user...

CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforc...

PT-2023-18180 · Axis Communications +1 · Axis License Plate Verifier +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is due to insufficient file permissions, allowing unprivileged users to access unencrypted user credentials used in the integration interface towards 3rd party systems...

CVE-2023-30367

Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...

Design/Logic Flaw

Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...