393 matches found
Design/Logic Flaw
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation ...
CVE-2022-4311
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation ...
CVE-2022-4311
Summary (CVE-2022-4311) : PcVue (ARC Informatique) versions 15–15.2.2 are affected by a vulnerability where sensitive information can be inserted into log files, allowing someone with log access to discover DbConnect data source connection strings and potentially credentials, leading to unauthori...
CVE-2022-4311
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation ...
PT-2022-7096
Name of the Vulnerable Software and Affected Versions PcVue versions 15 through 15.2.2 Description An issue exists where sensitive information is inserted into log files, potentially allowing users with access to these logs to discover connection strings of data sources configured for the...
ARC Informatique PcVue 日志信息泄露漏洞
ARC Informatique PcVue is a multifunctional HMI-SCADA software from ARC Informatique, France, an all-in-one solution that monitors all aspects of a customer's assets.PcVue is used in a wide range of applications such as industrial control, building management, energy management, smart grids, ener...
grafana: XSS vulnerability in data source handling
A Cross-site scripting XSS vulnerability was found in the way Grafana handles data sources. This flaw allows an attacker to serve HTML content through the Grafana data source or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site scripting...
grafana: Forward OAuth Identity Token can allow users to access some data sources
An information-disclosure flaw was found in grafana. When a data source has the Forward OAuth Identity feature enabled, sending a query to that data source with an API token and no other user credentials will forward the OAuth Identity of the most recently logged-in user. This flaw allows API tok...
CVE-2022-41091
creationtimestamp| type| source ---|---|--- 2022-11-08 20:27:53+00:00| published-proof-of-concept| https://t.me/alexmakus/4847 2022-11-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=913 2022-11-09 14:40:05+00:00| seen| https://t.me/truesecator/3680 2022-11-10...
grafana: Forward OAuth Identity Token can allow users to access some data sources
An information-disclosure flaw was found in grafana. When a data source has the Forward OAuth Identity feature enabled, sending a query to that data source with an API token and no other user credentials will forward the OAuth Identity of the most recently logged-in user. This flaw allows API tok...
CVE-2022-3780
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions...
CVE-2022-3780
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions...
CVE-2022-39050
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
Code injection
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
CVE-2022-39050
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
UBUNTU-CVE-2022-39050
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
CVE-2022-39050
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
CVE-2022-39050 Possible XSS stored in customer information
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
CVE-2022-36537
creationtimestamp| type| source ---|---|--- 2022-08-27 00:30:26+00:00| seen| https://t.me/cibsecurity/48923 2022-11-01 12:31:11+00:00| seen| https://t.me/thehackernews/2720 2022-12-09 12:28:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3580 2022-12-09 14:25:09+00:00|...
Three Reasons Why Unification Drives Modern Data Security Strategy
Today, the necessities of business innovation compel most organizations to have several teams with diverse priorities managing dozens of data sources, all with different structures. This makes it impossible to secure complete data repositories successfully using traditional methods. This post wil...