CVE-2022-47561 Unprotected Storage of Credentials in Ormazabal products

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious...

The vulnerability of the configuration import function of the AcSELerator QuickSet SEL-5030 device management tool allows a perpetrator to execute arbitrary code.

The vulnerability of the configuration import function of the AcSELerator QuickSet SEL-5030 device management tool relates to the lack of measures taken to protect the SQL query structure during the processing of DMX format files. Exploiting this vulnerability allows a perpetrator to execute...

CVE-2023-4984

A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit ha...

Authentication flaw

A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit ha...

CVE-2023-4984

CVE-2023-4984 affects didi KnowSearch versions 0.3.2 and 0.3.1.2. The root issue is processing in the API endpoint "/api/es/admin/v3/security/user/1" that leads to unprotected storage of credentials. The vulnerability can be triggered remotely, and the exploit has been disclosed publicly. Affecte...

CVE-2023-4984 didi KnowSearch 1 credentials storage

A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit ha...

The vulnerability of Adobe Experience Manager’s content and media data management system, which stems from the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the doRTAAccessUPass method in the software for testing and monitoring network quality by Visualware MyConnection Server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the doRTAAccessUPass method in the software for testing and monitoring network quality by Visualware MyConnection Server is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

PT-2023-25434 · Govee · Govee Home

Name of the Vulnerable Software and Affected Versions: Govee Home app affected versions not specified Description: The Govee Home app has unprotected access to the WebView component, which can be opened by any app on the device. By sending a URL to a specially crafted site, an attacker can execut...

PT-2023-5298 · Unknown · Modulys Gp

Name of the Vulnerable Software and Affected Versions: MODULYS GP MOD3GP-SY-120K affected versions not specified Description: The issue is related to the lack of security in the authentication process of the web application, allowing information to be obtained by sending specific requests. This i...

The vulnerability of the online business analytics service IBM Cognos Analytics, related to the lack of protection for operational data, allows a perpetrator to disclose protected information.

The vulnerability of the online business analytics service IBM Cognos Analytics lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to gain access to protected information remotely...

GHSA-F4R5-Q63F-GCWW Keylime registrar and (untrusted) Agent can be bypassed by an attacker

Impact A security issue was found in the Keylime registrar code which allows an attacker to effectively bypass the challenge-response protocol used to verify that an agent has indeed access to an AIK which in indeed related to the EK. When an agent starts up, it will contact a registrar and provi...

Unprotected initialize functions can front-run by MEV or by an Attacker

Lines of code Vulnerability details Vulnerability Detail It should be avoided that the implementation of proxy contracts can be initialized by third parties. This can be the case if the initialize function is unprotected. Since the implementation contract is not meant to be used directly without ...

The vulnerability of the CMD_W_REG command processor in the CEAR_MWDI_DFLT_PASSWORD register of the CE805M data collection and transmission device allows a attacker to compromise the integrity of the database or cause service failures.

The vulnerability of the CMDWREG command processor in the CEARMWDIDFLTPASSWORD registry of the CE805M data collection and transmission device is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the Cryptographic Services in the Windows operating system allows a perpetrator to disclose protected information.

The vulnerability of the Cryptographic Services in the Windows operating system is related to the lack of protection for service-related data. Exploiting this vulnerability can allow a perpetrator to disclose the protected information...

PT-2023-23138 · WordPress · Really Simple Plugins Recipe Maker For Your Food Blog From Zip Recipes

Name of the Vulnerable Software and Affected Versions: Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin versions 8.0.6 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious...

The vulnerability of the Softing edgeAggregator data integration tool lies in its lack of protection for website structures, allowing attackers to execute arbitrary code with root privileges.

The vulnerability of the Softing edgeAggregator data integration tool is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes, related to the failure to protect the SQL request structure, allows a perpetrator to execute arbitrary code.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to the lack of protective measures for the SQL request structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of component B1i Layer of the SAP Business One resource management system allows a hacker to gain access to read, modify, or delete data.

The vulnerability of component B1i Layer in the SAP Business One resource management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to remotely gain access to read, modify, or delete data by sending...

PT-2023-27173 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk Android versions prior to 17.0.0 Description: Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. An unprotected intent in versions prior to 17.0.0 allowed malicious third-party apps...