1470 matches found
Apache superset missing check for default SECRET_KEY
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset...
PT-2023-18961 · Sick · Sick Fx0-Gpnt00000 Flexisoft Pnet Gatew. +9
Name of the Vulnerable Software and Affected Versions: SICK UE410-EN3 FLEXI ETHERNET GATEW. versions all SICK UE410-EN1 FLEXI ETHERNET GATEW. versions all SICK UE410-EN3S04 FLEXI ETHERNET GATEW. versions all SICK UE410-EN4 FLEXI ETHERNET GATEW. versions all SICK FX0-GENT00000 FLEXISOFT EIP GATEW...
CVE-2023-23451
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number =2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number =2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number =2311xxxx all...
CVE-2023-27651
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the updateinfo field of the default.xml file...
CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed...
Siemens SCALANCE 加密问题漏洞
Siemens SCALANCE is a series of Ethernet switches from Siemens, Germany. It connects to Industrial Control System ICS devices, including Programmable Logic Controllers PLCs and Human Machine Interface HMI systems. A vulnerability exists in Siemens SCALANCE due to an encryption issue, which arises...
Default configuration
A user with non-Admin access can change a configuration file on the client to modify the Server URL...
Default configuration
Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by default is not in the official dropbear SSH server...
Default configuration
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that...
CVE-2023-1399
N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate privileges in the affected device’s default configuration and achieve remote code execution...
CVE-2022-3101
The CVE-2022-3101 entry affects tripleo-ansible, where an insecure default configuration leaves a sensitive file with insufficient permissions. This enables a local attacker to brute-force the relevant directory to discover the file, leading to disclosure of important OpenStack deployment configu...
UBUNTU-CVE-2023-28144
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevateperfprivileges.sh chown calls...
CVE-2023-26359
Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Rece...
CVE-2023-28144
KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevateperfprivileges.sh chown calls...
systemd security update
250-12.0.2.3 - Backport upstream pstore dmesg fix Orabug: 34868110 - Remove upstream references Orabug: 33995357 - Disable unprivileged BPF by default Orabug: 32870980 - udev rules: fix memory hot add and remove Orabug: 31310273 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 Orabug:...
CVE-2021-34182
An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...
CVE-2021-34182
An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...
Default configuration
An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions...