Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Note: This issue is a result of missing checks for services that require an active session. Remediation Upgrade asyncua to...

Dell CloudIQ 安全漏洞

Dell CloudIQ is a cloud-based proactive monitoring and predictive analytics tool from Dell USA. A security vulnerability exists in Dell CloudIQ Collector version 1.10.2, which stems from a lack of encryption of sensitive data and can be exploited by an attacker to gain access to unauthorized data...

Vulnerability fixed in IBM Spectrum Protect Plus

A vulnerability has been fixed in IBM Spectrum Protect Plus. The vulnerability allows a malicious person to access gain access to sensitive data. The malicious party can alter the communication flow via a Man-in-the-Middle attack between Spectrum Protect Plus vSnap and associated agents because i...

PT-2022-25992 · Alivecor · Kardiamobile

Name of the Vulnerable Software and Affected Versions: KardiaMobile affected versions not specified Description: The physical IoT device of the AliveCor's KardiaMobile has no encryption for its data-over-sound protocols. This issue could allow an attacker to read patient EKG results or create a...

CVE-2022-3644

The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...

CVE-2020-9058

Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection...

CVE-2020-9057

Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot direct...

Silicon Labs Z-Wave Chipsets 安全漏洞

Silicon Labs Z-Wave Chipsets is a chipset in the smart home ecosystem from Silicon Labs, Inc. in the United States. A security vulnerability exists in Silicon Labs Z-Wave Chipsets that stems from the fact that the chipset uses a CRC-16 package and does not implement encryption or replay protectio...

Z-Wave 安全漏洞

Z-Wave is a wireless communication protocol used primarily for home automation. It is a mesh network that uses low-power radio waves to communicate from device to device to wirelessly control appliances and other devices in the home, such as controlling lighting, security systems, thermostats,...

CVE-2021-35526

Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 Build Nr. 1.2.14002.257...

CVE-2020-27184

The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks...

CVE-2020-27184

The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications, making it vulnerable to Man-in-the-Middle attacks...

Baxter PrismaFlex and PrismMax Information Disclosure Vulnerabilities

The Baxter PrismaFlex and PrismMax are both critical care devices from Baxter. An information disclosure vulnerability exists in Baxter PrismaFlex all versions and PrismMax prior to version 3.x. The vulnerability stems from the failure of an affected device to encrypt e.g., TLS/SSL transmitted da...

CVE-2019-18980

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...

CVE-2019-18980

On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. Th...

The vulnerability of Siemens SIMATIC process control systems, related to errors in network access restrictions, allows a intruder to execute arbitrary code.

The vulnerability of the Siemens SIMATIC process control system is related to errors in network access restrictions, if “encrypted communication” is not utilized. Exploiting this vulnerability allows a perpetrator who has not undergone identity verification to execute arbitrary codes...

Xiongmai IP Cameras, NVRs and DVRs incl. 3rd party OEM devices lack encryption of sensitive data vulnerability

Hangzhou Xiongmai Information Technology Co., Ltd. specializes in security monitoring, video intelligence research and development. Xiongmai IP Cameras, NVRs and DVRs incl. 3rd party OEM devices suffer from a lack of encryption of sensitive data vulnerability, which could allow an attacker to...

SimpliSafe Original Information Disclosure Vulnerability (CNVD-2018-10490)

SimpliSafe Original is a home security management system. The system includes video surveillance and intrusion alarms, among other things. A security vulnerability exists in SimpliSafe Original that stems from a failure to encrypt transmissions. An attacker in close physical proximity could explo...

Mitochrome upgrade process has an arbitrary file download vulnerability

Meitu Xiu Xiu is a photo manipulation software. Mito Xiu Xiu in the upgrade process exists arbitrary file download vulnerability, due to the program in the update process does not use any encryption algorithms, the query domain name does not exist any checksum mechanism, the new version of the...

CVE-2017-15999

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...