PT-2023-6842 · Netis · Netis Netcore Router

Name of the Vulnerable Software and Affected Versions: Netis Netcore Router affected versions not specified Description: The issue is related to the Backup Handler component of the Netis Netcore Router, specifically with the file param.file.tgz. It involves the cleartext storage of critical...

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

...

Hitachi Energy FOXMAN-UN

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: FOXMAN-UN Vulnerabilities: Inadequate Encryption Strength, Use of Default Cryptographic Key, Use of Hard-coded Cryptographic Key, Cleartext Transmission of Sensitive...

Hitachi Energy UNEM

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: UNEM Vulnerabilities: Inadequate Encryption Strength, Use of Hard-coded Cryptographic Key, Cleartext Transmission of Sensitive Information. 2. RISK EVALUATION Successful...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to man-in-the-middle due to moment vulnerability [X-Force ID 238619]

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to man-in-the-middle due to moment vulnerability X-Force ID 238619 with details below. This has been addressed. Vulnerability Details IBM X-Force ID: 238619 DESCRIPTION: Moment Moment-Timezone is vulnerable to a...

CVE-2022-37785

An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins...

Design/Logic Flaw

An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins...

CVE-2022-37785

CVE-2022-37785 affects WeCube Platform 3.2.2. The issue is that cleartext passwords are displayed in the configuration for terminal plugins, exposing sensitive credentials in the configuration interface. The connected sources confirm the affected product/version and the exact weakness but do not ...

CVE-2022-37785

An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins...

PT-2023-13552 · Unknown · Wecube Platform

Name of the Vulnerable Software and Affected Versions: WeCube Platform version 3.2.2 Description: An issue was discovered where cleartext passwords are displayed in the configuration for terminal plugins. Recommendations: For WeCube Platform version 3.2.2, consider restricting access to the...

CVE-2022-37785

An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins...

CVE-2022-37785

An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins...

CVE-2022-24120

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0...

CVE-2022-24120

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0...

Default credentials

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0...

CVE-2022-24120

CVE-2022-24120 affects General Electric Renewable Energy iNET and iNET II radios (prior to firmware 8.3.0). The root cause is plaintext (cleartext) storage of credentials in the device flash memory, exposing sensitive data on affected systems. Impact is confidentiality risk (C:H) with vector like...

CVE-2022-24120

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0...

CVE-2022-24120

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0...

CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...

ALPINE-CVE-2022-41318

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...