SAP NetWeaver Integration Platform Session Interception

The vulnerability of the Pmitest server of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of administrators or...

SAP NetWeaver Integration Platform Session Interception

The vulnerability of the MDT software integration platform for SAP NetWeaver is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of an administrator or user of the w...

SAP Business Objects Session Interception

The vulnerability of the SAP Business Objects decision support system lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to intercept administrator or user sessions on the web resources, using specially crafted POST/GET...

SAP NetWeaver Integration Platform Session Interception

The vulnerability of the ProxyServer server of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of administrators ...

SAP NetWeaver Integration Platform Session Interception

The vulnerability of the Ecatt server, a software integration platform for SAP NetWeaver, is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of...

16 Cybercriminals Behind Mekotio and Grandoreiro Banking Trojan Arrested in Spain

Spanish law enforcement agencies on Wednesday arrested 16 individuals belonging to a criminal network in connection with operating two banking trojans as part of a social engineering campaign targeting financial institutions in Europe. The arrests were made in Ribeira A Coruña, Madrid, Parla and...

CVE-2021-36382

Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint which accepts cleartext...

Design/Logic Flaw

Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint which accepts cleartext...

PT-2021-3544

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the lack of protection for the web page structure in the Pmitest server of the SAP NetWeaver software integration platform. This can be exploited by a remote...

PT-2021-3545

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the lack of protection for the web page structure in the MDT server of the SAP NetWeaver software integration platform. Exploitation of this issue could allow a...

PT-2021-3543

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the ProxyServer of the SAP NetWeaver software integration platform, where the structure of web pages is not properly protected. This can be exploited by a remote...

Devolutions Server 信任管理问题漏洞

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server that originates in Devolutions Server prior to 2021.1.18 and LTS prior to 2020.3.20 that intercepts...

PT-2021-18612

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.7 Description The issue allows attackers to bypass the 2-factor authentication 2FA requirement. This is possible because the need to use 2FA for authentication is enforced client-side instead of server-side,...

Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability

Cisco Adaptive Security Device Manager ASDM is a simple, GUI-based firewall device management application. a remote code execution vulnerability exists in Cisco Adaptive Security Device Manager ASDM version 9.16.1 and earlier. The vulnerability stems from a lack of proper signature verification o...

FortiMail - Unauthenticated encryption in IBE leads to email plaintext recovery

A missing cryptographic step in FortiMail IBE may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible...

Philips Vue PACS 安全漏洞

Philips Vue PACS is an image management solution from Philips Europe. Philips Vue PACS suffers from a security vulnerability that arises from the software transmitting sensitive or security-critical data in clear text, a communication channel that can be sniffed by unauthorized actors...

Virus.Win32.Shodi.e Insecure Transit

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/37d4a5ba123dd32f1e2c4ba0be14e77c.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Virus.Win32.Shodi.e Vulnerability: Insecure Transit Description: The virus listens on TCP port 7352...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, an American company. A security vulnerability exists in a number of qualcomm products that stems from a weak configuration of the WLAN, causing unencrypted messages to be forwarded from one client to another. An attacker could exploit the...

Zenly: Friend Request Flow Exposes User Data

Summary: When submitting a friend request to a user, Zenly will allow access to their phone number regardless of whether the friend request is accepted or not. To obtain this information, a malicious actor only needs to know their username. Steps To Reproduce: To reproduce this issue, an...

hms admin appointment-history PHP Cookie Interception

The vulnerability of the \hms\admin\appointment-history.php web application, a hospital management system for PHPGurukul, is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to intercept cookie files...