EDK2 Security Vulnerability

EDK2 is a set of cross-platform firmware development environments from the Tianocore community based on the UEFI and PI specifications. EDK2 suffers from a security vulnerability that stems from allowing insecure default settings that allow an attacker to bypass secure boot...

Intel VROC software security vulnerability

Intel VROC software is an application from Intel Corporation USA. A security vulnerability exists in Intel VROC software prior to version 8.0.8.1001, which stems from an incorrect default privilege issue that could lead to privilege escalation via local access by an authenticated user...

Setting secure defaults on AWS and avoiding misconfigurations

Wiz cloud security researcher, Scott Piper, suggests measures organizations can adopt to ensure secure defaults on AWS and improve their security posture...

Automatic Conditional Access policies in Microsoft Entra streamline identity protection

Extending our commitment to help customers be secure by default, today were announcing the auto-rollout of Microsoft Entra Conditional Access policies that will automatically protect tenants based on risk signals, licensing, and usage. Weve designed these policies based on our deep knowledge of t...

PT-2023-6585 · Sielco · Sielco Polyeco1000

Name of the Vulnerable Software and Affected Versions: Sielco PolyEco1000 affected versions not specified Description: The issue is related to insufficient restriction of authentication attempts and the use of a weak set of default administrative credentials in the Sielco PolyEco1000 digital...

CVE-2023-46233

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...

Knime Analytics Platform Cross-Site Scripting Vulnerability

Knime Analytics Platform is a free and open source data analytics, reporting and integration platform from Knime, Switzerland. A cross-site scripting vulnerability exists in KNIME Analytics Platform versions prior to 5.2.0, which arises from insecure default settings that allow cross-site scripti...

August 22, 2023—KB5029351 (OS Build 22621.2215) Preview

None None...

CVE-2023-4324

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers...

CVE-2023-4324

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers...

CVE-2023-4324 Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers...

PT-2023-28741

Name of the Vulnerable Software and Affected Versions Broadcom RAID Controller affected versions not specified Description The Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers. This issue affects the web interface, makin...

PT-2023-28821 · Broadcom · Broadcom Raid Controller

Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller affected versions not specified Description: The Broadcom RAID Controller web interface is vulnerable due to insecure defaults, specifically the lack of an HTTP strict-transport-security policy. This issue can be...

CVE-2023-4342: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy...

CLSA-2023-1689701864 perl: Fix of CVE-2023-31486

CVE-2023-31486: add verifySSL=1 to HTTP::Tiny default configuration...

CLSA-2023-1689701433 perl: Fix of CVE-2023-31486

CVE-2023-31486: add verifySSL=1 to HTTP::Tiny default configuration...

Insecure Defaults

Overview Affected versions of this package are vulnerable to Insecure Defaults. The library poses a major security risk that can likely be exploited to extract sensitive information or fully compromise the application. An attacker is be able to perform character by character brute-force of...

PT-2023-4084 · Siemens · Simatic Cn 4100

Name of the Vulnerable Software and Affected Versions: SIMATIC CN 4100 versions prior to V2.5 Description: A vulnerability has been identified in the SIMATIC CN 4100, related to an incorrect default value in the SSH configuration. This issue could allow an attacker to bypass network isolation. Th...

CVE-2023-3485

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

Race condition

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...