CVE-2023-0714

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious...

PT-2024-41073 · Ооо 'Нпо Мир' · Контроллер Мир Кт-51 +4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to weak password requirements, which can be exploited by a remote attacker to perform a brute force attack. Recommendations: At the moment, there is no information about...

U.S. Dept Of Defense: Improper Authentication Allows Making Requests as Other Users

A vulnerability was discovered that allowed unauthenticated users to submit requests as other users by manipulating HTTP responses. The vulnerability was caused by the application's failure to enforce strict authentication checks on sensitive endpoints, and its inability to properly validate serv...

RHEL 8 : edk2 (RHSA-2024:5297)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5297 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware f...

PT-2024-19055 · Bmra · Bmra

Name of the Vulnerable Software and Affected Versions: BMRA software versions prior to 22.08 Description: The issue is related to inadequate encryption strength, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions pri...

Siemens Location Intelligence Weak Password Vulnerability

Location Intelligence is a web-based application that creates transparency in production and logistics processes based on location data, thus uncovering optimization potential. Siemens Location Intelligence suffers from a weak password vulnerability that can be exploited by attackers to conduct...

CVE-2023-31305

Generation of weak and predictable Initialization Vector IV in PMFW Power Management Firmware may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure...

CVE-2023-31305

Generation of weak and predictable Initialization Vector IV in PMFW Power Management Firmware may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure...

edk2: Use of a Weak PseudoRandom Number Generator

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information...

CVE-2024-40697

IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895...

CVE-2024-40697

IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895...

CVE-2024-40697 IBM Common Licensing information disclosure

IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895...

CVE-2024-40697

IBM Common Licensing 9.0 is vulnerable to weak password policy; affected components include IBM Common Licensing Agent 9.0 and ART 9.0. Root cause: password requirements are not enforced by default. Impact: potential compromise of user accounts. Remediation: update to IBM Common Licensing 9.0.0.1...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41681

A vulnerability has been identified in Location Intelligence family All versions V4.4. The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connectio...

CVE-2024-41681

A vulnerability has been identified in Location Intelligence family All versions V4.4. The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connectio...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41683

CVE-2024-41683 affects Siemens Location Intelligence (web-based application) prior to version 4.4. The vulnerability is listed as Weak Password Requirements (CWE-521): affected products do not enforce a strong user password policy, which could allow a brute-force attack against legitimate user pa...

CVE-2024-41683

A vulnerability has been identified in Location Intelligence family All versions V4.4. Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords...

CVE-2024-41681

Siemens Location Intelligence (web-based Location Intelligence) is affected for all versions before V4.4. The root issue is that the web server is configured to support weak ciphers by default, enabling an on-path attacker in an adjacent network position to read and modify data between clients an...