Svakom Siime Eye security vulnerability

Svakom Siime Eye is a smart home device from Svakom USA. A security vulnerability exists in Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14, which originates from the fact that when a backup file is created through the web interface, information about all users can be found in plaintext in...

PT-2024-34634 · Froala · Froala Wysiwyg Editor

Name of the Vulnerable Software and Affected Versions: Froala WYSIWYG editor versions 4.3.0 and earlier Description: The issue is related to inconsistent parsing of the tag, which allows for cross-site scripting XSS in the Froala WYSIWYG editor. Recommendations: For versions 4.3.0 and earlier,...

CVE-2024-51434

Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier...

openSUSE 15 Security Update : kmail-account-wizard (openSUSE-SU-2024:0353-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0353-1 advisory. - CVE-2024-50624: Fixed that plaintext HTTP was used for URLs when retrieving configuration files boo1232454, kde487882 Tenable has extracted the precedi...

Red Hat Keycloak security vulnerabilities

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from the environment option not working and the JGroups replication configuratio...

OPENSUSE-SU-2024:0353-1 Security update for kmail-account-wizard

This update for kmail-account-wizard fixes the following issues: - CVE-2024-50624: Fixed that plaintext HTTP was used for URLs when retrieving configuration files boo1232454, kde487882...

Cisco Meeting Server information leakage vulnerability

Cisco Meeting Server Acano Conferencing Server is the United States Cisco Cisco company's set of audio and video conferencing server software. An information disclosure vulnerability exists in Cisco Meeting Server, which stems from improper storage of sensitive information in the Web management...

CVE-2023-29114: Exposure of Sensitive Information to an Unauthorized Actor

System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sensitive information: • Wi-Fi access point credentials to which the EV charger can connect. • APN web address and credentials. • IPSEC credentials...

PT-2024-12194

Name of the Vulnerable Software and Affected Versions Enel X Waybox versions prior to the fixed version Description The issue is related to a lack of access control in the web management application, allowing system logs to be accessed. An attacker can obtain sensitive information, including Wi-F...

D3D Security IP Camera Plaintext Information Disclosure

The vulnerability of the microprogrammed network IP camera D3D Security IP Camera D8801 lies in the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials through a specially created HTTP packe...

CVE-2024-10523

CVE-2024-10523 affects TP-Link IoT Smart Hub. Root cause: storage of Wi‑Fi credentials in plaintext in the device firmware, enabling credential extraction by analyzing the firmware if an attacker has physical access. Impact: disclosure of Wi‑Fi credentials stored on the vulnerable device. Exploit...

CVE-2024-10523 Information Disclosure Vulnerability in TP-Link IoT Smart Hub

This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable...

TP-LINK IoT Smart Hub security vulnerability

TP-LINK IoT Smart Hub is a series of smart hubs from China's Universal Link TP-LINK. A security vulnerability exists in TP-LINK IoT Smart Hub versions prior to 1.5.22, which originates from storing Wi-Fi credentials in plaintext within the device's firmware, which allows an attacker to extract th...

WS-2022-0328

etcd user credentials are stored in WAL logs in plaintext...

CVE-2024-48353

Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information...

CVE-2024-48353

Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information...

CVE-2024-48353: Insecure Storage of Sensitive Information

Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information...

CVE-2024-48353

CVE-2024-48353 affects Yealink Meeting Server prior to v26.0.0.67. The issue arises from static key information being obtainable from a front‑end JavaScript file, enabling an attacker to decrypt plaintext passwords using the exposed key data. The vulnerability is described across multiple sources...

PT-2024-41474 · Hikvision · Ds-2Cd1Xxxg0 +11

Уязвимость реализации протокола HTTP служб DynDNS и NO-IP микропрограммного обеспечения IP-камер Hikvision связана с передачей конфиденциальной информации в незашифрованном виде. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить атаку типа «человек посередине»...

AnythingLLM security vulnerabilities

AnythingLLM is an all-in-one AI application open-sourced by Mintplex. A security vulnerability exists in versions of AnythingLLM prior to 1.0.3, which stems from sensitive information being incorrectly stored in a JWT used as a token bearer in single-user mode, which when decoded displays the...