12516 matches found
Weintek cMT security breach
Weintek cMT is a Human Machine Interface application from Weintek. A security vulnerability exists in Weintek cMT that stems from the presence of an authenticated command injection vulnerability that allows an attacker to execute arbitrary code or access sensitive information by injecting a craft...
We Asked ChatGPT for 2024 Cybersecurity Predictions but You Should Make These Resolutions Instead
By Caitlin Condon, Senior Manager, Vulnerability Research at Rapid7, and Christiaan Beek, Senior Director, Threat Analytics at Rapid7 It’s that time of year again — time for the annual tradition of cybersecurity predictions. Here at Rapid7 we’ve seen a whole lot of threats and exploited...
The vulnerability of the software for creating and managing graphical user interfaces in industrial automation systems like SCADA CONPROSYS HMI Systems lies in the use of a password hash instead of a password for authentication. This allows attackers to exploit this flaw to disclose sensitive information through a “man-in-the-middle” attack.
The vulnerability of the SCADA CONPROSYS HMI System lies in the use of a password hash instead of a plain-text password for authentication. Exploiting this vulnerability allows an attacker, operating remotely, to disclose sensitive information through a “man-in-the-middle” attack...
Gradio Command Injection Vulnerability
Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a command injection vulnerability that stems from the application exposing sensitive information to unauthorized participants...
The vulnerability of the microprogramming software of the Ubiquiti Networks UniFi Dream Machine Pro, related to deficiencies in access control, allows intruders to circumvent domain restrictions.
The vulnerability of the microprogrammed software of the Ubiquiti Networks UniFi Dream Machine Pro relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass domain restrictions using specially created packages...
CVE-2023-46247
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...
Design/Logic Flaw
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...
CVE-2023-46247 Vyper has incorrect storage layout for contracts containing large arrays
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, gain access to sensitive data, or to impersonate another user via a cross-site scripting attack. Such an attack can lead to execution of...
GHSA-M5PC-86X8-WCXG Exposure of Sensitive Information in mltable
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
Exposure of Sensitive Information in mltable
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
CVE-2023-35625
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
CVE-2023-35624
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2023-35625
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
CVE-2023-35625
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
CVE-2023-35624
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2023-35624
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
Information disclosure
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...