30762 matches found
📄 WatchGuard Firebox Default Credentials / SSH Access
The default configuration of WatchGuard Firebox devices through 2025-09-10 allows administrative access via SSH on port 4118 using the default credentials. This configuration exposes the device to remote attackers who can gain full administrative access without prior authentication. CVE-2025-5939...
CVE-2025-63293
FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API...
CVE-2025-63293
Product: FairSketch Rise Ultimate Project Manager & CRM 3.9.4. Vulnerability: Insecure Permissions in the ticketing/commenting API, allowing a remote authenticated user to append comments or upload attachments to tickets they should not view/edit due to missing authorization checks. Impact (per s...
CVE-2025-64389
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...
Astra Linux – Vulnerability in open-vm-tools
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper with local files to trigger insecure file operations within that VM...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: vsock: Fixed the transport TOCTOU issue. The transport assignment may race with module unloading. This issue is addressed by protecting newtransport from becoming a stale pointer. This also includes fixing an insecure call in...
CVE-2025-34274
Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...
CVE-2020-36868
Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some...
CVE-2024-13994
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation,...
EUVD-2025-37356
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...
EUVD-2025-37350
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
CVE-2025-64389
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...
CVE-2025-64389 EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...
CVE-2025-64389
CVE-2025-64389 involves the web server on Circutor TCPRS1plus devices that exchanges sensitive information in clear text via an insecure protocol. Concrete details across connected sources indicate the vulnerability stems from transmitting credentials/data without encryption, enabling potential i...
CVE-2025-64389 EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT
The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...
CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS
The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...
CVE-2025-64386
CVE-2025-64386 describes a JWT-based session hijacking flaw in Circutor TCPRS1plus (and related entries in multiple feeds). During an active session, an attacker can reuse a previously issued JWT token to modify security parameters or steal the session without detection. The issue is rooted in th...
CVE-2025-36249 IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
EUVD-2024-55057
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation,...
EUVD-2020-30810
Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some...