Nuki Bridge 安全漏洞

Nuki Bridge is a smart lock control software from Nuki. A security vulnerability exists in Nuki Bridge v1.x prior to v1.22.0 and v2.x prior to v2.13.2, and Nuki Keypad v1.9.2 prior to v1.9.2, which stems from a publicly available HTTP API that uses an unencrypted channel to provide a management...

CVE-2022-32510

An issue in Nuki Bridge where the HTTP API admin interface was exposed over an unencrypted channel, allowing an attacker who can access the network to eavesdrop a token and impersonate a legitimate user to access the full API. Affected: Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2. Root caus...

CVE-2022-32510

An issue was discovered on certain Nuki Home Solutions devices. The HTTP API exposed by a Bridge used an unencrypted channel to provide an administrative interface. A token can be easily eavesdropped by a malicious actor to impersonate a legitimate user and gain access to the full set of API...

PT-2024-11574 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions 1.0.0 through 1.21.0 Nuki Bridge versions 2.0.0 through 2.13.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where the HTTP API exposed by a Bridge used an unencrypted channel to provide an...

GHSA-94PR-W968-H923 Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml on the Jenkins controller as part of its configuration. This token can be viewed by users with access to the...

CVE-2024-34147

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2024-34147

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2024-34147

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2024-34147

Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2024-34147

CVE-2024-34147 affects the Jenkins Telegram Bot Plugin (versions 1.4.0 and earlier). The vulnerability stems from storing the Telegram Bot token in plaintext in the global configuration file on the Jenkins controller (jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml), which can be...

Jenkins plugins Multiple Vulnerabilities (2024-05-02)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - High Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are...

The vulnerability of the Test Agent component of the testing and monitoring platform for physical, hybrid, and virtual networks in Juniper Networks’ Junos OS Evolved network devices of the ACX series allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Test Agent component of the testing and monitoring platform for physical, hybrid, and virtual networks in Paragon Active Assurance for Juniper Networks’ Junos OS Evolved network devices of the ACX series is related to the unencrypted storage of user data. Exploiting this...

CVE-2024-29952

A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables...

CVE-2024-29952

A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables...

CVE-2024-29952

CVE-2024-29952 affects Brocade SANnav prior to v2.3.1 and v2.3.0a. An authenticated user can exploit command-variable manipulation to cause logs to disclose Auth, Priv, and SSL key store passwords in plaintext. The vulnerability has a local attack vector with low attack complexity and no user int...

CVE-2024-29952 Clear text storage of sensistive information by manipulating command variables

A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables...

CVE-2024-29952 Clear text storage of sensistive information by manipulating command variables

A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables...

Broadcom Brocade SANnav 安全漏洞

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom Corporation USA. A security vulnerability exists in Broadcom Brocade SANnav versions prior to v2.3.1, v2.3.0a, which stems from a vulnerability that allows authenticated users to print Auth, Priv, and SSL keystore...

The vulnerability of the AutomationDirect C-MORE EA9 HMI software’s microprogramming system, related to unencrypted storage of critical information, allows a intruder to gain unauthorized access to protected data.

The vulnerability of the Microprogrammed Control Panel Software of AutomationDirect C-MORE EA9 HMI relates to the unencrypted storage of critical information. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

PT-2024-3595 · Redis +2 · Redis +2

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A flaw in Quay's storage of its database in plain text within the mirror-registry on Jinja's config.yaml file poses a risk. This issue could allow a malicious actor with access to this file to...