Fedora 38 : 389-ds-base (2023-c92be0dfa0)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c92be0dfa0 advisory. Bump version to 2.3.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2023-2375)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could...

Hashed Emergent Announces India Blockchain Week (IBW) Conference

By Owais Sultan India Blockchain Week is part of a week-long series of web3-focused events taking place from December 4-10, 2023.… This is a post from HackRead.com Read the original post: Hashed Emergent Announces India Blockchain Week IBW Conference...

CVE-2023-36608

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

Code injection

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

CVE-2023-36608

CVE-2023-36608 concerns the use of MD5 to hash stored passwords in Ovarro TBox RTUs. The root cause is an insecure cryptographic algorithm for password storage, affecting multiple TBox firmware lines (e.g., MS-CPU32, MS-CPU32-S2, LT2, TG2, RM2) with versions listed up to 1.50.598 and prior for so...

CVE-2023-36608

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

CVE-2023-36608

The affected TBox RTUs store hashed passwords using MD5 encryption, which is an insecure encryption algorithm...

Information Disclosure

flaskappbuilder is vulnerable to Information Disclosure. The vulnerability exists in the crud operator functions in interface.py due to log messages which are not properly sanitized during database errors, allowing an admin authenticated attacker to gain access to sensitive user information such ...

CVE-2023-2623 KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users...

CVE-2023-2623 KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users...

CVE-2023-34110

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on t...

Design/Logic Flaw

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on t...

CVE-2023-34110

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on t...

CVE-2023-34110

Flask-AppBuilder (the Flask-based application framework) is affected by CVE-2023-34110. An authenticated admin could trigger a database error by entering a special character on the Add/Edit User form, with certain database engines potentially exposing the entire user row, including the pbkdf2:sha...

CVE-2023-34110 Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on t...

CVE-2023-34110

Removed by vendor...

Exploit for Missing Authorization in Intelbras Sg_2404_Mr_Firmware

CVE-2023-36144 PoC of CVE-2023-36144 - Intelbras Switch SG 24...

GHSA-JHPR-J7CQ-3JP3 Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Impact An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the...

PT-2023-24682

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.3.2 Description An authenticated malicious actor with Admin privileges could trigger a database error by adding a special character on the add or edit User forms. This error can be surfaced back to the acto...