3118 matches found
CVE-2023-21408 Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP
Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials that are used in the integration interface towards 3rd party systems...
CVE-2023-21408
CVE-2023-21408: The description indicates an issue of insufficient file permissions that could let unprivileged users access unencrypted credentials used by the integration interface to third-party systems. The provided metrics show a high to critical impact (confidentiality, integrity, availabil...
CVE-2023-38952
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforc...
ZKTeco BioTime Security Breach
ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime v8.5.5 that could allow an unauthenticated attacker to read sensitive backup files and access sensitive information such as user...
PT-2023-18180 · Axis Communications +1 · Axis License Plate Verifier +1
Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is due to insufficient file permissions, allowing unprivileged users to access unencrypted user credentials used in the integration interface towards 3rd party systems...
CVE-2023-30367
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
Design/Logic Flaw
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
CVE-2023-30367
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
CVE-2023-30367
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
Information Disclosure
org.jenkins-ci.plugins:dimensionsscm is vulnerable to Information Disclosure. A remote authenticated attacker with Item/Configure permission is able to gain access to confidential user credentials due to improper authorization checks, resulting in the disclosure of sensitive information...
The vulnerability of the Telnet service of the cable modem Hitron CODA-5310 allows a intruder to gain access to user and administrator credentials.
The vulnerability of the Telnet service of the Microcable Gateway Hitron CODA-5310 lies in the transmission of confidential information in plaintext. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to user and administrator credentials...
AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plaintext
All-In-One Security AIOS, a WordPress plugin installed on over one million sites, has issued a security update after a bug introduced in version 5.1.9 of the software caused users' passwords being added to the database in plaintext format. "A malicious site administrator i.e. a user already logge...
CVE-2023-35697
Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials...
CVE-2023-35697
The CVE-2023-35697 refers to the SICK ICR890-4 track-and-trace device, with the root cause described as improper restriction of excessive authentication attempts, enabling a remote attacker to brute-force credentials. Publicly documented details indicate the vulnerability affects SICK ICR890-4 an...
GHSA-7J6X-42MM-P7JM Zinc Cross-site Scripting vulnerability
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’...
Zinc Cross-site Scripting vulnerability
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
PT-2023-25297 · Unknown · Piigab M-Bus
Name of the Vulnerable Software and Affected Versions: PiiGAB M-Bus affected versions not specified Description: The issue allows a low-level user to potentially gain admin credentials because PiiGAB M-Bus stores credentials in a plaintext file. Recommendations: At the moment, there is no...
CVE-2023-21176
In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...
CVE-2023-21176
In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...