CVE-2022-22385

The CVE-2022-22385 issue affects IBM Security Verify Privilege On-Premises 11.5, where sensitive information can be disclosed due to data being transmitted in clear text. The vulnerability concerns the confidentiality of data in transit and is tied to IBM’s On-Premises Privilege Manager. Remediat...

PT-2023-12694 · Ibm · Ibm Security Verify Privilege On-Premises

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Privilege On-Premises version 11.5 Description: The issue could disclose sensitive information to an attacker due to the transmission of data in clear text. Recommendations: For IBM Security Verify Privilege On-Premises...

PYSEC-2023-203

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

Cross-Origin Cookie Leakage

Undici is vulnerable to Cross-Origin Cookie Leakage. The vulnerability is due to a failure to clear cookie headers which may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target...

Delta Electronics WPLSoft Security Vulnerability

Delta Electronics WPLSoft is a software tool for programming Delta Programmable Logic Controllers PLCs from Delta Electronics, Inc. of Taiwan, China. A security vulnerability exists in Delta Electronics WPLSoft version 2.51, which originates from the transmission of sensitive information in clear...

Chromecookiestealer - Steal/Inject Chrome Cookies Over The DevTools Protocol

Attaches to Chrome using its Remote DevTools protocol and steals/injects/clears/deletes cookies. Heavily inspired by WhiteChocolateMacademiaNut. Cookies are dumped as JSON objects using Chrome's own format. The same format is used for cookies to be loaded. For legal use only. Features Dump Chrome...

CLSA-2023-1696537325 Fix of 10 CVEs

SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2018-25009.patch: add additional check to avoid read over the header - CVE-2018-25009 SECURITY UPDATE: a heap-based buffer overflow - debian/patches/CVE-2018-25010.patch: limit the filter size to not exceed the image dimensions -...

Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) Credential Disclosure

Electrolink FM/DAB/TV Transmitter login.htm/mail.htm Credentials Disclosure Vendor: Electrolink s.r.l. Product web page: https://www.electrolink.com Affected version: 10W, 100W, 250W, Compact DAB Transmitter 500W, 1kW, 2kW Medium DAB Transmitter 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter 100...

K000136907: BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43124

Security Advisory Description BIG-IP APM clients may send IP traffic outside of the VPN tunnel. CVE-2023-43124 Impact If a client machine connects to a malicious adjacent network device, such as a router or Wi-Fi hotspot, an attacker may be able to trick the client into sending IP traffic outside...

K000136909: BIG-IP APM Clients TunnelCrack vulnerability CVE-2023-43125

Security Advisory Description BIG-IP APM clients may send IP traffic outside of the VPN tunnel. CVE-2023-43125 Impact If a client machine connects to a malicious DNS device, an attacker may be able to trick the client into sending IP traffic outside of the VPN tunnel. Any clear text traffic leake...

CVE-2022-47561

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

CVE-2022-47561

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

Design/Logic Flaw

UNSUPPPORTED WHEN ASSIGNED The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to...

CVE-2022-47561 Unprotected Storage of Credentials in Ormazabal products

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

CVE-2022-47561 Unprotected Storage of Credentials in Ormazabal products

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

CVE-2022-47561

CVE-2022-47561 concerns Ormazabal products where credentials are stored in clear text in admin.xml and can be accessed without logging in, exposing all user credentials (including admin). Public documents confirm the vulnerability and its impact on confidentiality, with exposure of credentials en...

cleardigital.co.nz Cross Site Scripting vulnerability OBB-3688596

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2023-3301

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service...

CVE-2023-4918

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are abl...

Default credentials

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are abl...