Default credentials

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-27494

CVE-2022-27494 affects Aethon TUG Home Base Server prior to version 24. The vulnerability is a cross-site scripting (stored XSS) in the Reports tab of the Fleet Management Console, caused by insufficient input sanitization in the Reports component. An unauthenticated attacker could inject JavaScr...

CVE-2022-27494 CROSS-SITE SCRIPTING CWE-79

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1070 CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1070 CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1059

CVE-2022-1059 affects Aethon TUG Home Base Server versions prior to 24. The vulnerability is a reflected cross-site scripting (XSS) flaw in the Load tab of the Fleet Management Console. Unauthenticated attackers could trigger/script injection through this tab, potentially accessing data or impact...

CVE-2022-1059 CROSS-SITE SCRIPTING CWE-79

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1059 CROSS-SITE SCRIPTING CWE-79

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-26423 MISSING AUTHORIZATION CWE-862

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-26423 MISSING AUTHORIZATION CWE-862

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-26423

CVE-2022-26423 affects the Aethon TUG Home Base Server (versions before 24). The vulnerability stems from missing authorization (CWE-862), enabling an unauthenticated attacker to freely access hashed user credentials. Affected product: TUG Home Base Server. Impact described in connected sources i...

CVE-2022-1066 MISSING AUTHORIZATION CWE-862

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1066 MISSING AUTHORIZATION CWE-862

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

Zinc Delete Template Function Cross-Site Scripting Vulnerability

Zinc is a full-text indexing search engine open sourced by Zinc Labs. Zinc v0.1.9 and later, v0.3.1 and earlier versions have a cross-site scripting vulnerability that can be exploited by attackers to obtain sensitive information such as user credentials...

Zinc delete user function cross-site scripting vulnerability

Zinc is a full-text indexing search engine open sourced by Zinc Labs. Zinc v0.1.9 and later, v0.3.1 and earlier versions have a cross-site scripting vulnerability that could be exploited by attackers to obtain sensitive information such as user credentials...

CVE-2022-32171

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...

Cross site scripting

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...

CVE-2022-32171 Zinc - Stored XSS

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...

etcd user credentials are stored in WAL logs in plaintext

The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure...

Velneo vClient Certificate Validation Error Vulnerability

Velneo vClient is a complete enterprise application development platform from Velneo. A certificate validation error vulnerability exists in Velneo vClient version 28.1.3, which stems from a default failure to properly check the authenticity of certificates, and can be exploited by an attacker to...