Phoenix Contact Classic Line Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC, AXC, RFC, PC WORX, FC Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Phoenix Contact ProConOS and MULTIPROG

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ProConOS/ProConOS eCLR and MULTIPROG Vulnerability: Insufficient Verification of Data Authenticity CISA is aware of a public report, known as “OT:ICEFALL” that details...

Siemens SINEMA Remote Connect Server Data Authenticity Verification Error Vulnerability

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunneled connections VPN between headquarters, service technicians, and installed machines or plants.Siemens SINEMA Remote Connect Server is vulnerable to a data authenticity validation error, which could b...

Siemens SINEMA Remote Connect Server 数据伪造问题漏洞

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunneled connections VPN between headquarters, service technicians, and installed machines or plants.Siemens SINEMA Remote Connect Server is vulnerable to a data authenticity validation error, which could b...

The vulnerability of the software for centralized device management in Fortinet’s FortiManager system stems from insufficient verification of data authenticity. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the software for centralized device management in Fortinet FortiManager is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected informatio...

Researchers Find New Malware Attacks Targeting Russian Government Entities

An unknown advanced persistent threat APT group has been linked to a series of spear-phishing attacks targeting Russian government entities since the onset of the Russo-Ukrainian war in late February 2022. "The campaigns ... are designed to implant a Remote Access Trojan RAT that can be used to...

Cross site scripting

Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerability in Opal Hotel Room Booking plugin = 1.2.7 at WordPress...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to the lack of verification in the AxMessage process. An attacker can modify potentially sensitive AX information without detection by performing a man-in-the-middle MITM attack...

GHSA-WX7C-8J35-MPG8 Fat Free CRM Cross-Site Request Forgery vulnerability

Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery CSRF attacks via a request without the authenticitytoken, as demonstrated by a crafted HTML page that creates a new administrator account...

GHSA-X8XR-RM9R-7MVF OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

Insufficient Verification of Data Authenticity in Apache Tomcat

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Insufficient Verification of Data Authenticity in Async Http Client

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client aka AHC or async-http-client before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate...

CVE-2022-24889 Insufficient Verification of Data Authenticity in Nextcloud Server

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surfac...

CVE-2022-24889 Insufficient Verification of Data Authenticity in Nextcloud Server

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surfac...

Red Lion DA50N

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Red Lion Equipment: DA50N Vulnerabilities: Insufficient Verification of Data Authenticity, Weak Password Requirements, Use of Unmaintained Third-Party Components, Insufficiently Protected Credentials 2...

[WP-H22] Bad debts should not continue to accrue interest

Lines of code Vulnerability details uint256 debtAmount = getDebtAmountnftIndex; require debtAmount = getLiquidationLimitnftIndex, "positionnotliquidatable" ; // burn all payment stablecoin.burnFrommsg.sender, debtAmount; In the current design/implementation, the liquidator must fully repay the...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

CVE-2021-4031 Syltek Insufficient Verification of Data Authenticity

Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification...

The vulnerability of BIOS microprogramming systems in Dell laptops, related to insufficient verification of data authenticity, allows attackers to gain unauthorized access to protected information.

The vulnerability of BIOS microprogramming systems in Dell laptops is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Pexip Infinity licensing issue vulnerability

Pexip Infinity is a cloud collaboration platform for video conferencing from Pexip, a Norwegian company. A security vulnerability exists in Pexip Infinity Connect versions prior to 1.8.0, which stems from the omission of certain resource provisioning authenticity checks. An attacker could exploit...