CVE-2023-2335 Plaintext Password in Registry

Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows Registery modules allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0...

CVE-2023-2335 Plaintext Password in Registry

Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows Registery modules allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0...

HTML Injection

matrix-react-sdk is vulnerable to HTML Injection. The vulnerability exists in the bodyToHtml function of HtmlUtils.tsx because it does not escape the plainBody parameter of the highlighter attribute, which allows an attacker to inject and execute malicious plaintext messages with HTML payloads...

CVE-2023-2297

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...

CVE-2023-2297

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...

Sql injection

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...

PT-2023-18921 · 42Gears · 42Gears Surelock

Name of the Vulnerable Software and Affected Versions: 42gears surelock windows versions 2.3.12 through 2.40.0 Description: The issue allows retrieval of admin user credentials due to plaintext passwords being stored in the registry. This is related to the surelockwinsetupv2.40.0.Exe on Windows,...

42Gears Surelock 安全漏洞

42Gears Surelock is an industry-leading tool from 42Gears USA that locks devices into kiosk mode. A security vulnerability exists in 42Gears Surelock Windows versions 2.3.12 through 2.40.0, which stems from a plaintext password in the registry that allows the retrieval of administrator user...

Vtech VCS754 安全漏洞

The Vtech VCS754 is a conference phone from Vtech Hong Kong, China. A security vulnerability exists in the Vtech VCS754 version 1.1.1.A to versions prior to 1.1.1.H, which originates from passing a plaintext password in raw HTML. An attacker could exploit the vulnerability to escalate privileges...

CVE-2023-2297 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...

PT-2023-18803 · WordPress · The Profile Builder – User Profile & User Registration Forms

Name of the Vulnerable Software and Affected Versions: The Profile Builder – User Profile & User Registration Forms plugin for WordPress versions up to, and including 3.9.0 Description: The issue arises from the plugin's use of native password reset functionality with insufficient validation on t...

FreeBSD : element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting (c676bb1b-e3f8-11ed-b37b-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c676bb1b-e3f8-11ed-b37b-901b0e9408dc advisory. - matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior ...

Bare Metal Operator 信息泄露漏洞

Bare Metal Operator is an open source application from Metal³ that uses the Kubernetes API to manage bare metal hosts. An information disclosure vulnerability exists in Bare Metal Operator versions prior to 0.3.0, which stems from the presence of plaintext username and hashed password disclosure...

CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

HTML injection in search results via plaintext message highlighting

Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. Cross-site scripting is possible by including resources from recaptcha.net and...

GHSA-XV83-X443-7RMW HTML injection in search results via plaintext message highlighting

Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. Cross-site scripting is possible by including resources from recaptcha.net and...

Ribose RNP 安全漏洞

Ribose RNP is an application from Ribose, Inc. A security vulnerability exists in Ribose RNP versions prior to 0.15.1 that stems from the lack of implementation of a required step in the cryptographic algorithm, resulting in faulty encryption and leaving the key in the plaintext state...

The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the CURL command line utility is related to the transmission of critical information in plaintext when IDN symbols in host names are replaced with similar ASCII symbols. Exploiting this vulnerability can allow an unauthoriz...

Palo Alto Networks PAN-OS 8.1.x < 8.1.24 / 9.0.x < 9.0.17 / 9.1.x < 9.1.15 / 10.0.x < 10.0.12 / 10.1.x < 10.1.8 / 10.2.x < 10.2.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.24 or 9.0.x prior to 9.0.17 or 9.1.x prior to 9.1.15 or 10.0.x prior to 10.0.12 or 10.1.x prior to 10.1.8 or 10.2.x prior to 10.2.3. It is, therefore, affected by a vulnerability. - A vulnerability in Palo...

CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...