2162 matches found
Code injection
Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...
CVE-2020-12496 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor
Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...
CVE-2020-12496
The CVE-2020-12496 entry concerns Endress+Hauser Ecograph T and Memograph M devices (Firmware v2.0.0 and above). A server-side access-control matrix misconfiguration allows a low-privilege user to access endpoints that should be restricted, leading to exposure of sensitive information. The firmwa...
CVE-2020-12495 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management
Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...
CVE-2020-12495
The CVE-2020-12495 entry concerns Endress+Hauser Ecograph T (Neutral/Private Label) devices (RSG35, ORSG35) with firmware
Endress+hauser Ecograph Information Disclosure Vulnerability
The Endress+hauser Ecograph is a data logger from Endress+Hauser Switzerland. It is used to record and visualize all process sequences safely and completely. An information disclosure vulnerability exists in Endress+hauser Ecograph T version V2.0.0 and later versions, which stems from the easy...
Don’t Put It on the Internet: Tesla Backup Gateway Edition
Derek Abdine, formerly Director of Rapid7 Labs, now CTO at Censys, contributed this blog post. This blog post aims to increase user awareness of the privacy and security risks of connecting devices to the internet. In this edition, we address Tesla Backup Gateways and identify some key areas wher...
RUSTSEC-2020-0119 ReadTicket and WriteTicket should only be sendable when T is Send
Affected versions of this crate unconditionally implemented Send for ReadTicket & WriteTicket. This allows to send non-Send T to other threads. This can allows creating data races by cloning types with internal mutability and sending them to other threads as T of ReadTicket/WriteTicket. Such data...
RUSTSEC-2020-0135 Slock<T> allows sending non-Send types across thread boundaries
Slock unconditionally implements Send/Sync. Affected versions of this crate allows sending non-Send types to other threads, which can lead to data races and memory corruption due to the data race...
`LockWeak<T>` allows to create data race to `T`.
In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...
RUSTSEC-2020-0134 `LockWeak<T>` allows to create data race to `T`.
In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...
The vulnerability of the Core server component of Oracle WebLogic Server allows a hacker to execute arbitrary code.
The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using IIOP and T3 protocols from a remote location...
The vulnerability of the Core server component of Oracle WebLogic Server allows a hacker to gain full control over the application.
The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to gain full control over the application using IIOP and T3 protocols...
Google Forms Abused to Phish AT&T Credentials
Researchers are warning of phishing attacks that leverage Google Forms as a landing page to collect victims’ credentials. The forms masquerade as login pages from more than 25 different companies, brands and government agencies. So far, 265 different Google Forms used in these attacks have been...
t-pension.com Cross Site Scripting vulnerability OBB-1483342
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
t-shirt.monogra.net Cross Site Scripting vulnerability OBB-1481844
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
t-post.com Cross Site Scripting vulnerability OBB-1481207
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
t-s-o.ru Cross Site Scripting vulnerability OBB-1479208
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
The vulnerability of VMware NSX-T network virtualization platform, related to incorrect security requirements, allows a attacker to execute a “man-in-the-middle” attack.
The vulnerability of VMware NSX-T network virtualization platform is related to incorrect security requirements. Exploiting this vulnerability can allow a malicious actor to execute a “man-in-the-middle” attack...
t-s-o.ru Cross Site Scripting vulnerability OBB-1468364
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...