CVE-2023-27975

CVE-2023-27975 affects Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340/M580 PLCs. Root cause: CWE-522 Insufficiently Protected Credentials allowing a local user to tamper memory and gain unauthorized access to a project file; CVSS v3.1 base score 7.1 (H...

Schneider Electric Modicon M340 Trust Management Issue Vulnerability

The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. The Schneider Electric Modicon M340 is vulnerable to a trust management issue that arises from the use of hard-coded credentials, which...

The vulnerability of the FactoryTalk Services Platform, related to incorrect verification of the cryptographic signature, allows a perpetrator to gain unauthorized access to protected information and alter arbitrary settings.

The vulnerability of the FactoryTalk Services Platform relates to improper verification of the cryptographic signature. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information and alter arbitrary settings...

The vulnerability of the XWiki platform, caused by deficiencies in the authentication process, allows unauthorized users to gain access to protected information.

The vulnerability of the XWiki platform stems from deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in the unencrypted storage of critical information, which allows attackers to disclose protected data.

The vulnerability of the XWiki Platform lies in the unencrypted storage of critical information. Exploiting this vulnerability could allow a malicious actor to disclose the protected data remotely...

The vulnerability of the `getRemoteUrl2File` function in the `src\main\java\com\java3y\austin\support\utils\AustinFileUtils.java` file of the ZhongFuCheng3y Austin software, which allows a hacker to disclose protected information.

The vulnerability of the getRemoteUrl2File function in the src\main\java\com\java3y\austin\support\utils\AustinFileUtils.java file of the ZhongFuCheng3y application is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to disclose...

The vulnerability of the xwiki-platform-office-viewer component of the XWiki Platform, a platform for creating collaborative web applications. This component allows attackers to view the content of files on the hosting server.

The vulnerability of the xwiki-platform-office-viewer component of the XWiki Platform, a platform for creating collaborative web applications, relates to the disclosure of protected information. Exploiting this vulnerability could allow an attacker to remotely access and view the content of files...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow, related to the disclosure of protected information, allows attackers to reveal the configuration of arbitrary tasks.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to the exposure of protected information. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the configuration of arbitrary tasks...

The vulnerability of the Apache Airflow network software, related to the exposure of protected information, allows attackers to view warnings related to all DAGs in Airflow.

The vulnerability of the Apache Airflow network software relates to the exposure of protected information. Exploiting this vulnerability allows a malicious actor to monitor all DAGs in Airflow...

The vulnerability of the Suricata intrusion detection and prevention system, related to the use of memory after it is freed, allows an intruder to influence the integrity and accessibility of the protected information.

The vulnerability of the Suricata intrusion detection and prevention system lies in the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to influence the integrity and accessibility of the protected information...

Microsoft Outlook 安全漏洞

Microsoft Outlook is a suite of e-mail applications from the American company Microsoft. A remote code execution vulnerability exists in Microsoft Outlook, which can be exploited by an attacker to bypass the protected view protocol, obtain local NTLM credentials, and execute arbitrary code with...

The vulnerability of the Solr software solution for enterprise resource planning by Apache OFBiz, which allows attackers to modify protected information

The vulnerability of the Solr software for enterprise resource planning software Apache OFBiz lies in the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to remotely modify protected information...

PT-2024-2808 · Schneider Electric · Ecostruxure Process Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert affected versions not specified EcoStruxure Process Expert affected versions not specified Description: A Use of Hard-coded Credentials issue exists that could cause unauthorized access to a project file protected...

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer, related to reading data outside the buffer in memory, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the 3D model texturing program Adobe Substance 3D Designer lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

PT-2024-3864 · Sap · Sap Fiori App

Name of the Vulnerable Software and Affected Versions: SAP Fiori app My Overtime Request version 605 Description: The issue is related to the absence of necessary authorization checks for authenticated users, which may lead to an escalation of privileges. It is possible to manipulate the URLs of...

PT-2024-10063 · Qualcomm · Qualcomm Security Processor

Name of the Vulnerable Software and Affected Versions: Qualcomm security processor software affected versions not specified Description: The issue is related to memory corruption when allocating and accessing an entry in an SMEM partition continuously. This can lead to reading beyond the valid...

CVE-2024-0596

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editorhtml function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with...

CVE-2023-50291

CVE-2023-50291 — Insufficiently Protected Credentials (Apache Solr) : The issue affects Solr 6.0.0–8.11.2 and 9.0.0–9.3.0, where the /admin/info/properties endpoint could leak credentials because some sensitive properties (e.g., basicauth, aws.secretKey) were published in the UI. Access is gated ...

CVE-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

The vulnerability of Lenovo Tab M8 HD’s microprogramming software relates to the ability to disclose information, allowing a intruder to access protected data.

The vulnerability of Lenovo Tab M8 HD tablet’s microprogramming software is related to the disclosure of information. Exploiting this vulnerability can allow an intruder to disclose the protected information...