772 matches found
Top Bar < 3.0.5 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Top Bar" in WP Admin 2. Save...
CVE-2024-2728
Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol...
CVE-2024-2728
CVE-2024-2728 affects the CIGESv2 system. The issue is an information exposure due to an improper TLS implementation, enabling a local attacker to intercept traffic. Affected component is the CIGESv2 system’s TLS handling; impact is confidentiality loss with no integrity/availability impact state...
The vulnerability of the Keycloak identity and access management software lies in its authentication procedures’ flaws, which allow attackers to intercept active sessions.
The vulnerability of the Keycloak identity and access management software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to intercept an active session...
CVE-2024-2371
Information exposure vulnerability in Korenix JetI/O 6550 affecting firmware version F208 Build:0817. The SNMP protocol uses plaintext to transfer data, allowing an attacker to intercept traffic and retrieve credentials...
CVE-2023-50916
Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a...
CVE-2023-48427
A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 2. Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses,...
ParaSiteSnatcher: How Malicious Chrome Extensions Target Brazil
We detail the modular framework of malicious Chrome extensions that consist of various highly obfuscated components that leverage Google Chrome API to monitor, intercept, and exfiltrate victim data...
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
Description The plugin does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition. 1- Install and activate kk Star Ratings. 2- Go to the page that displays the star rating. 3- Using Burp and the Turbo Intruder extension, intercept the rating...
CVE-2023-20264
A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 single sign-on SSO for remote access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to intercept the SAML...
CVE-2023-20264
A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 single sign-on SSO for remote access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to intercept the SAML...
Design/Logic Flaw
The Android Client application, when enrolled with the define method 1 the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...
CVE-2023-45321
The Android Client application, when enrolled with the define method 1 the user manually inserts the server ip address, use HTTP protocol to retrieve sensitive information ip address and credentials to connect to a remote MQTT broker entity instead of HTTPS and this feature is not configurable by...
Tennessee Valley Authority: internal path disclosure via register error
Vulnerability description not provided...
F5 BIG-IP Next SPK Hardcoded Credentials Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. A hard-coded credential vulnerability exists in F5 BIG-IP Next SPK, which can be exploited by an attacker with the ability to...
CVE-2023-45226
The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is only exposed when ssh debug is...
CVE-2023-45226 BIG-IP Next SPK SSH vulnerability
The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is only exposed when ssh debug is...
CVE-2023-45226
CVE-2023-45226 affects BIG-IP Next SPK, specifically the f5-debug-sidecar and f5-debug-sshd containers in SPK TMM. The issue is hardcoded credentials that could let an attacker intercept traffic and impersonate the SPK SSH server when ssh debug is enabled. Exposure is documented in multiple sourc...
K000135874: BIG-IP Next SPK SSH vulnerability CVE-2023-45226
Security Advisory Description The BIG-IP SPK TMM Traffic Management Module f5-debug-sidecar and f5-debug-sshd containers contain hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell SSH server on those containers. This is expos...
