140 matches found
CVE-2022-3090
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This coul...
CVE-2022-3090
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This coul...
Red Lion Crimson
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Red Lion Controls Equipment: Crimson Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain user credential hashes. 3...
Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2021-22876 and CVE-2021-22890)
Summary There are vulnerabilities in Curl that affect PowerSC. Vulnerability Details CVEID: CVE-2021-22876 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to strip off user credentials from the URL when automatically populating the...
PT-2022-3559 · Aethon · Aethon Tug Home Base Server
Name of the Vulnerable Software and Affected Versions: Aethon TUG Home Base Server versions prior to version 24 Description: The issue is related to the lack of input data sanitization in the "Загрузки" component of the TUG Home Base Server, which can lead to a remote attacker conducting a...
SUSE-SU-2021:2423-1 Security update for systemd
This update for systemd fixes the following issues: Security issues fixed: - CVE-2021-33910: Fixed a denial of service stack exhaustion in systemd PID 1 bsc1188063 Other fixes: - mount-util: shorten the loop a bit 7545 - mount-util: do not use the official MAXHANDLESZ 7523 - mount-util: tape over...
CVE-2021-23984
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This...
FortiProxy SSL VPN user credential plaintext storage
...
Design/Logic Flaw
Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential...
Design/Logic Flaw
The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential...
CVE-2020-27646
Biscom Secure File Transfer SFT before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft...
CVE-2020-27646
Biscom Secure File Transfer SFT before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft...
CVE-2020-26584
An issue was discovered in Sage DPW 202006x before 202006002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link, he can execute arbitrary JavaScript code in the user's browser. The vulnerability can ...
Responsive Online Blog 1.0 SQL Injection Vulnerability (2)
Exploit for php platform in category web applications Exploit Title: Responsive Online Blog 1.0 - 'single.php?id=' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...
CVE-2020-4044
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This wi...
CVE-2020-2004
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...
The Coronavirus is Already Taking Effect on Cyber Security– This is How CISOs Should Prepare
The Coronavirus is hitting hard on the world’s economy, creating a high volume of uncertainty within organizations. Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. In light o...
Security Bulletin: IBM ToolsCenter Suite is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)
Summary Security vulnerabilities have been discovered in OpenSSL. Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTL Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL. Content Vulnerability...
CVE-2017-1000474
The CVE refers to Soyket Chowdhury Vehicle Sales Management System (VSMS) v2017-07-30 with multiple vulnerabilities in login scripts (vehicle.php, profile.php, Actions.php, manage_employee.php, sell.php) enabling SQL Injection and Stored XSS that can lead to remote code execution. Connected data ...
