CVE-2024-9620 Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption

A flaw was found in Event-Driven Automation EDA in Ansible Automation Platform AAP, which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access...

CVE-2024-9620

CVE-2024-9620 affects Red Hat Ansible Automation Platform’s Event-Driven Automation (EDA) component, where sensitive information is not encrypted. The issue allows an attacker with network access to sniff plaintext data transmitted between EDA and AAP, or with system access to read plaintext data...

CVE-2024-9620 Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption

A flaw was found in Event-Driven Automation EDA in Ansible Automation Platform AAP, which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access...

CVE-2024-9620

A flaw was found in Event-Driven Automation EDA in Ansible Automation Platform AAP, which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access...

PT-2024-7770 · Siemens · Siemens Sentron 7Km Pac3200

Name of the Vulnerable Software and Affected Versions: Siemens SENTRON 7KM PAC3200 All versions Description: A vulnerability has been identified in the Modbus TCP interface of the Siemens SENTRON 7KM PAC3200, where affected devices only provide a 4-digit PIN to protect from administrative access...

Red Hat Ansible Automation Platform 安全漏洞

Red Hat Ansible Automation Platform Red Hat AAP is a unified solution for enabling strategic automation from Red Hat USA. A security vulnerability exists in Red Hat Ansible Automation Platform that stems from a lack of encryption of sensitive information, which could allow an attacker with networ...

ROS-20241008-02

A vulnerability in the Portainer container management platform is related to an improperly used algorithm encryption algorithm in the AesEncrypt function. Exploitation of the vulnerability could allow an attacker acting remotely to compromise the confidentiality, integrity, and availability of...

PT-2024-7671 · Cypress · Cypress Bluetooth Sdk

Name of the Vulnerable Software and Affected Versions: Cypress Bluetooth SDK version 3.66 Description: The issue is related to a buffer overflow in the memory when handling the data header length field of the LL Pause Enc Req, which is part of the Bluetooth Low Energy BLE technology. This can be...

PT-2024-10440 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance 10.0.2 Identity Manager Description: The issue is related to the transmission of user credentials in clear text by the Identity Manager component, which could be obtained by an attacker using man-in-the-middle...

PT-2024-38167

Name of the Vulnerable Software and Affected Versions: eWeLink affected versions not specified Description: A local attacker can decrypt TLS communication and extract secrets to clone the device via flashing modified firmware due to a missing SSL pinning implementation. Recommendations: At the...

Inadequate Encryption Strength

github.com/portainer/portainer is vulnerable to Inadequate Encryption Strength. The vulnerability is due to the improper use of an encryption algorithm in the AesEncrypt function. An attacker can decrypt sensitive information or compromise data integrity by exploiting the weak encryption...

Threat Brief: Understanding Akira Ransomware

Overview Akira is a prolific ransomware that has been operating since March 2023 and has targeted multiple industries, primarily in North America, the UK, and Australia. It functions as a Ransomware as a Service RaaS and exfiltrates data prior to encryption, achieving double extortion. According ...

CVE-2024-20448

A vulnerability in the Cisco Nexus Dashboard Fabric Controller NDFC software, formerly Cisco Data Center Network Manager DCNM, could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within conf...

CVE-2024-20448 Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability

A vulnerability in the Cisco Nexus Dashboard Fabric Controller NDFC software, formerly Cisco Data Center Network Manager DCNM, could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within conf...

CVE-2024-20448

The CVE-2024-20448 involves Cisco Nexus Dashboard Fabric Controller (NDFC) (formerly DCNM). It stems from improper storage of sensitive data in config-only and full backup files, enabling an attacker with access to a backup generated by an affected device to view sensitive information, including ...

CVE-2024-44097

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. T...

CVE-2024-8885

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files...

CVE-2024-8885

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files...

CVE-2024-8885

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files...

CVE-2024-8885

The CVE-2024-8885 entry pertains to a local privilege escalation in Sophos Intercept X for Windows with Central Device Encryption, affecting version 2024.2.0 and earlier. The root cause is tied to unsupported third‑party components within the Device Encryption component, enabling arbitrary file w...