88 matches found
Do Not Enable the TFTP Service
Trivial File Transfer Protocol TFTP is used for file transfer between a Linux server and other servers, desktop systems, as well as terminal devices. TFTP does not support authentication and encryption mechanisms. Data tends to be forged, tampered with, or stolen by attackers during communication...
CVE-2025-8763
A vulnerability was found in Ruijie EG306MG 3.01B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strongswan.conf of the component strongSwan. The manipulation of the argument idontcareaboutsecurityanduseaggressivemodepsk leads to missing...
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2025-0432
EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage...
CVE-2025-0432
EWON Flexy 202 exposes credentials by transmitting them in clear text via the device web page when a user is added or credentials are changed. Root cause: lack of encryption/cleartext transmission. Impact: confidentiality of credentials is HIGH. Several sources corroborate the issue; however, no ...
CVE-2024-55928
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption...
libreswan: IKEv1 default AH/ESP responder can crash and restart
A flaw was found in Libreswan, where it was identified to contain an assertion failure issue in the computeprotokeymat function. The vulnerability can be exploited when an IKEv1 connection is loaded with an AH/ESP default setting when no esp= line is present in the connection. This flaw allows an...
CVE-2024-53275 GHSL-2024-091: DNS rebinding attack in home-gallery
Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. I...
The vulnerability of the Modbus TCP interface of the microprogramming software used in multifunctional measuring instruments for measuring electrical network parameters from Siemens SENTRON 7KM PAC3200 allows a perpetrator to circumvent existing security restrictions and gain unauthorized access to protected information.
The vulnerability of the Modbus TCP interface of Siemens SENTRON 7KM PAC3200 multifunctional measuring instruments for measuring electrical network parameters lies in improper authentication mechanisms. This includes insufficient security measures, such as a weak 4-digit PIN code, and the absence...
PT-2024-7770 · Siemens · Siemens Sentron 7Km Pac3200
Name of the Vulnerable Software and Affected Versions: Siemens SENTRON 7KM PAC3200 All versions Description: A vulnerability has been identified in the Modbus TCP interface of the Siemens SENTRON 7KM PAC3200, where affected devices only provide a 4-digit PIN to protect from administrative access...
SyroTech SY-GPON-1110-WDONT 安全漏洞
The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...
PT-2024-37301 · Unknown · Soar Cloud Hr Portal
Name of the Vulnerable Software and Affected Versions: Soar Cloud HR Portal affected versions not specified Description: The issue concerns notification emails sent by Soar Cloud HR Portal, which contain a link with embedded session data. These emails are sent without using an encrypted...
PHOENIX CONTACT CHARX SEC Security Breach
PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC, which stems from a lack of encryption of sensitive data in the MITM, resulting in an unauthenticated, remote attacker being able to...
PT-2024-3658 · Ge Healthcare · Ge Healthcare Echopac
Name of the Vulnerable Software and Affected Versions: GE HealthCare EchoPAC products affected versions not specified Description: The issue concerns vulnerable data in transit in GE HealthCare EchoPAC products, which is related to the lack of encryption measures. This could allow a remote attack...
PYSEC-2023-189
Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Note: This issue is a result of missing checks for services that require an active session...
UBUNTU-CVE-2023-26150
Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Note: This issue is a result of missing checks for services that require an active session...
Mozilla: Push notifications saved to disk unencrypted
The Mozilla Foundation Security Advisory describes this flaw as: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information...
CVE-2023-4420
A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption in the communication channel can lead to the unauthorized disclosure of sensitive information. The attacker can...
PT-2023-29148 · Sick · Sick Lms5Xx
Name of the Vulnerable Software and Affected Versions: SICK LMS5xx affected versions not specified Description: A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption...
