ICSA-18-317-06 Siemens SIMATIC STEP 7 (TIA Portal)

1. EXECUTIVE SUMMARY CVSS v3 4.0 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: SIMATIC STEP 7 TIA Portal Vulnerability: Unprotected Storage of Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to reconstruct passwords. 3...

ThreatList: Dead Web Apps Haunt 70 Percent of FT 500 Firms

A study of abandoned websites owned by leading global corporations hammers home the point that old web applications need to be properly mitigated or retired. Otherwise, these resources often haunt a firm long after they have been forgotten. Researchers at High-Tech Bridge used the Financial Times...

11 million personal unprotected MongoDB records leaked online

By Uzair Amir Another day, another trove of sensitive data exposed online. This time, a MongoDB database containing a whopping 43.5GB of the dataset used in marketing campaigns has been left exposed for public access. The data was discovered by Bob Diachenko, an independent security researcher wh...

Ice Qube Thermal Management Center

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Ice Qube Equipment: Thermal Management Center Vulnerabilities: Improper Authentication, Unprotected Storage of Credentials 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

Information disclosure

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

EETHER integer overflow vulnerability

EETHER is an Ether-based digital currency. An integer overflow vulnerability exists in the unprotected 'distributeToken' function in EETHER's smart contract implementation. An attacker could exploit the vulnerability to increase their digital assets...

CloudBees Jenkins Agiletestware Pangolin Connector for TestRail Plugin Data Modification Vulnerability

CloudBees Jenkins is a set of Java-based development of continuous integration tools from CloudBees, Inc. in the U.S. It is mainly used to monitor continuous software version release/testing projects and some timed tasks.Agiletestware Pangolin Connector for TestRail Plugin is A plugin for uploadi...

CVE-2018-1999032

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

Design/Logic Flaw

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

Insufficiently Protected Credentials

The Jenkins AWS CodeBuild Plugin does not properly protect credentials in AWSClientFactory...

Thousands of Mobile Apps Expose Their Unprotected Firebase Hosted Databases

Mobile security researchers have discovered unprotected Firebase databases of thousands of iOS and Android mobile applications that are exposing over 100 million data records, including plain text passwords, user IDs, location, and in some cases, financial records such as banking and cryptocurren...

Thousands of Mobile Apps Expose Their Unprotected Firebase Hosted Databases

Mobile security researchers have discovered unprotected Firebase databases of thousands of iOS and Android mobile applications that are exposing over 100 million data records, including plain text passwords, user IDs, location, and in some cases, financial records such as banking and cryptocurren...

22K Open, Vulnerable Containers Found Exposed on the Net

More than 22,000 container orchestration and API management systems are unprotected or publicly available on the internet – highlighting the reality of the risks of operating workloads in the cloud. According to research from Lacework, the containers Kubernetes, Mesos, Docker Swarms and more suff...

The vulnerability of the microprogramming software of the Zyxel Multy X AC3000 lies in the lack of protection for the UART interface, which allows a hacker to gain access to the device with root privileges.

The vulnerability of the Zyxel Multy X AC3000 router’s microprogramming software lies in the lack of protection for the UART interface and the use of pre-installed credentials. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges via the...

Google Chrome Views Unauthorized Access Vulnerability

Google Chrome is a web browser developed by Google, Inc.Views is one of the view components. A security vulnerability exists in Views in versions of Google Chrome prior to 67.0.3396.62, which stems from a failure to use operating system protection for password fields. An attacker could exploit th...

Redis Server compromised by 'RedisWannaMine' Attack - Active Check

The remote Redis server is unprotected and has been compromised via the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vgate iCar 2 Wi-Fi OBD2 Dongle Authentication Bypass Vulnerability

Vgate iCar 2 Wi-Fi OBD2 Dongle is an automotive fault detection device from VgateTechnology, China. An authentication bypass vulnerability exists in the Vgate iCar 2 Wi-Fi OBD2 Dongle, which stems from the fact that the wireless LAN that the device opens is not protected by an encrypted or...

CVE-2018-11476

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...