The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, relates to the lack of data encryption measures. This allows a perpetrator to retrieve the credentials for authentication purposes.

The vulnerability of the Wiser Smart programmable logic controllers from Schneider Electric, Wiser Controller EER21000 and Wiser Controller EER21001, lies in the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to retrieve authentication credentials fo...

CVE-2022-29733

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allows attackers to intercept HTTP Cookie authentication credentials via a man-in-the-middle attack...

The Myths of Ransomware Attacks and How To Mitigate Risk

Today's modern companies are built on data, which now resides across countless cloud apps. Therefore preventing data loss is essential to your success. This is especially critical for mitigating against rising ransomware attacks — a threat that 57% of security leaders expect to be compromised by...

GSD-2022-1002522 backdoor in phpass version 0.3.x-dev, 0.3.x

In PHP phpass version 0.3.x-dev, 0.3.x a backdoor exists in the phpass package that can be attacked via malicious package update resulting in credential theft...

GHSA-M6GF-P26P-MX2W Jenkins Docker Plugin contains Cross-Site Request Forgery

A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpldoTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

GSD-2022-1002521 backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6

In PyPI ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6 a backdoor exists in the ctx package that can be attacked via a malicious package update resulting in credential theft from environment variables...

IBM Jazz Team Server 跨站脚本漏洞

IBM Jazz Team Server is an application server from IBM USA. Provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality. A cross-site scripting vulnerability exists ...

Jenkins SSH Plugin Cross-Site Request Forgery Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins SSH Plugin 2.6.1 and earlier...

Ukrainian Hacker Jailed for 4-Years in U.S. for Selling Access to Hacked Servers

A 28-year-old Ukrainian national has been sentenced to four years in prison for siphoning thousands of server login credentials and selling them on the dark web for monetary gain as part of a credential theft scheme. Glib Oleksandr Ivanov-Tolpintsev, who pleaded guilty to his offenses earlier thi...

PT-2022-20304 · Unknown · Terminalfour

Name of the Vulnerable Software and Affected Versions: Terminalfour versions 8.2.x prior to 8.2.18.2.1 Terminalfour versions 8.2.x prior to 8.2.18.5 Terminalfour versions 8.3.x prior to 8.3.8 Description: The issue allows an attacker to exploit a vulnerability that could mislead an administrator...

GHSA-VCVP-89FQ-HWJ8 Apache Sling Authentication Service vulnerability

A flaw in the org.apache.sling.auth.core.AuthUtilisRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials...

CVE-2022-1650

A flaw was found in the EventSource NPM Package. The description from the source states the following message: "Exposure of Sensitive Information to an Unauthorized Actor." This flaw allows an attacker to steal the user's credentials and then use the credentials to access the legitimate website...

CVE-2022-22797

Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input...

Sysaid Technologies Sysaid 输入验证错误漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. Sysaid Technologies Sysaid suffers from a security vulnerability that stems from a lack of validation of the input accepted by the program.Unauthenticated redirection and forwarding may occu...

dovecot: plaintext commands injection

It was found that dovecot could still accept plaintext commands while the STARTTLS negotiation process is ongoing. This could allow an active person in the middle, with valid credentials on dovecot, to, for example, steal confidential data such as the client's emails and passwords...

WBCE CMS 跨站脚本漏洞

WBCE CMS is a WBCB CMS forum that converts HTML to WBCB CMS templates.A cross-site scripting vulnerability exists in WBCE CMS version 1.5.2, which can be exploited by attackers to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging in again and then...

IBM InfoSphere Information Server 跨站脚本漏洞

IBM InfoSphere Information Server is a data integration software platform. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server, which can be exploited by attackers to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging i...

Limbas 跨站脚本漏洞

Limbas is a web-based enterprise software factory. A cross-site scripting vulnerability exists in Limbas version 4.3.36.1319, which can be exploited to execute malicious code, tamper with pages to perform phishing attacks, and trick users into logging in again and then obtaining their login...

CVE-2021-38904

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693...

Design/Logic Flaw

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693...