AlmaLinux 8 : git (ALSA-2023:3246)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3246 advisory. - Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7,...

Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises

Summary IBM Engineering Requirements Quality Assistant On-Premises affected by multiple vulnerabilities due to which an attacker could exploit this vulnerability to execute arbitrary code on the system and cause the application to crash cause a denial of service condition on the system. This...

CVE-2022-0010

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

CVE-2022-0010

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

CVE-2022-0010 QCS 800xA Vulnerability identified in system log files

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

CVE-2022-0010

Summary: CVE-2022-0010 affects ABB QCS 800xA, ABB QCS AC450, and ABB Platform Engineering Tools due to insertion of sensitive information into log files. An attacker with local access to QCS nodes could obtain a system user password and potentially take control of nodes. Affected versions: QCS 80...

eBankIT 6 Arbitrary OTP Generation

CVE-2023-33291 Description In eBankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any email address or phone number without validation. ------------------------------------------ Additional Information The cookies in the...

PT-2023-9780 · Abb · Abb Platform Engineering Tools +2

Name of the Vulnerable Software and Affected Versions: ABB QCS 800xA versions 1.0;0 through 6.1SP2 ABB QCS AC450 versions 1.0;0 through 5.1SP2 ABB Platform Engineering Tools versions 1.0:0 through 2.3.0 Description: The issue is related to the insertion of sensitive information into log files in...

ABB’s multiple products have vulnerabilities related to log information leakage

ABB QCS and ABB Platform Engineering Tools are both products of ABB Switzerland.ABB QCS is a family of quality control systems.ABB Platform Engineering Tools is a platform tool. A security vulnerability exists in several ABB products, which can be exploited by an attacker who already has local...

CVE-2022-0010: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

Cyber Signals: Shifting tactics fuel surge in business email compromise

Today we released the fourth edition of Cyber Signals highlighting a surge in cybercriminal activity around business email compromise BEC. Microsoft has observed a 38 percent increase in cybercrime as a service CaaS targeting business email between 2019 and 2022.1 Successful BEC attacks cost...

OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users

A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. "OilAlpha used encrypted chat messengers like WhatsApp to launch...

Authentication flaw

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

CVE-2023-2706 OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

MAL-2023-622 Malicious code in next2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a38f3ed2458e9188f19672ebadf7f1bf9aae21e644c654fb82d93cc4b55abed0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-950 Malicious code in vue2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 471c4327f895aee34fd25c781189cda3025f1a3d22c0bba59cd767f95a277194 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in next2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a38f3ed2458e9188f19672ebadf7f1bf9aae21e644c654fb82d93cc4b55abed0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Schweitzer Engineering Laboratories RTAC Cross-site Scripting (CVE-2023-31159)

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

Schweitzer Engineering Laboratories RTAC Cross-site Scripting (CVE-2023-31160)

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...