CVE-2021-43564

An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...

PT-2021-4796 · Microsoft · Windows Remote Desktop Protocol +1

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Protocol RDP affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows Remote Desktop Protocol RDP component of the Windows operating system. Exploitation ...

WordPress OptinMonster plugin <= 2.6.4 - Unprotected REST-API to Sensitive Information Disclosure and Unauthorized API access vulnerability

Unprotected REST-API to Sensitive Information Disclosure and Unauthorized API access vulnerability discovered by Chloe Chamberland WordFence in WordPress OptinMonster plugin versions = 2.6.4. Solution Update the WordPress OptinMonster plugin to the latest available version at least 2.6.5...

OptinMonster < 2.6.5 - Unprotected REST-API Endpoints

OptinMonster was missing appropriate capability checks on several REST-API endpoints which made it possible for unauthenticated attackers, and in some instances authenticated with low privileges, to perform unauthorized actions, as well as access sensitive information such as the...

The vulnerability of the “edate” parameter in the xhisalarm.htm component of the HMI/SCADA application xArrow allows attackers to perform cross-site scripting attacks.

The vulnerability of the “edate” parameter in the xhisalarm.htm component of the HMI/SCADA application xArrow is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

Mozilla: Downgrade attack on SMTP STARTTLS connections

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

CVE-2021-0693

In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected provider. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0693

In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected provider. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

The vulnerability of Mermaid software for generating diagrams and block diagrams lies in the lack of measures taken to protect the structure of web pages, allowing attackers to compromise data integrity.

The vulnerability of Mermaid software for generating diagrams and block diagrams is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...

CVE-2021-23858

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...

Information disclosure

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...

Default credentials

The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables...

CVE-2021-23855

The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables...

CVE-2021-23855 Information disclosure

The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables...

CVE-2021-23858

CVE-2021-23858 describes an information-disclosure vulnerability affecting Bosch Rexroth IndraMotion Mlc devices. An unprotected web server resource exposes the main configuration (including users and hashed passwords) and another unprotected resource exposes device details (serial number and fir...

CVE-2021-23858 Information disclosure

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...

PT-2021-15571 · Rexroth +1 · Indramotion Mlc L20 +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue involves information disclosure where the main configuration, including users and their hashed passwords, is exposed through an unprotected web server resource. This...

PT-2021-15568 · Rexroth +1 · Indramotion Mlc Indramotion Xlc +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns an exposed user and password database due to an unprotected web server resource. The passwords are hashed using a weak hashing algorithm, making them susceptible ...

The vulnerability of SonicWall SMA series 100 network firewall microprogramming software, related to the lack of protection for SQL query structures, allows attackers to gain unauthorized access to protected information.

The vulnerability of SonicWall SMA 100 network firewall microprogramming software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Smart Email Alerts WordPress plugin lies in its lack of protection for website structures, allowing attackers to inject arbitrary web scripts.

The vulnerability of the /views/settings.php file in the Smart Email Alerts WordPress plugin exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts remotely...