Totolink N350RT 代码问题漏洞

The TOTOLINK N350RT is a small home router from China's Gion Electronics TOTOLINK. The TOTOLINK N350RT suffers from a session hijacking vulnerability, which is caused by insufficient session expiration in the /cgi-bin/cstecgi.cgi script. An attacker could use this vulnerability to access other...

php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

A vulnerability was found in PHP where the weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP allows a remote authenticated attackers to cause a stack information leak...

PT-2024-10091 · Drupal · Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Two-factor Authentication TFA versions 0.0.0 through 1.5.0 Description: The issue is related to a weak authentication vulnerability in the Two-factor Authentication TFA module for Drupal, which can be exploited to abuse authentication. This...

CVE-2023-7237 Lantronix XPort Weak Encoding for Password

Lantronix XPort sends weakly encoded credentials within web request headers...

CVE-2023-7237

CVE-2023-7237 affects Lantronix XPort (XPort Device Server Configuration Manager, v2.0.0.13) where credentials are weakly encoded in web request headers. The issue is documented in multiple sources (NVD, CISA ICS advisory) with CVSS v3.1 base score 5.7 (ATT&CK details not explicitly stated). The ...

CVE-2023-7237 Lantronix XPort Weak Encoding for Password

Lantronix XPort sends weakly encoded credentials within web request headers...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools for installation work on production lines allows a perpetrator to load any desired files.

The vulnerability of the NEXO-OS operating system for tools used in production line maintenance, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious acto...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. This is achieved by exploiting multiple vulnerabilities, including an undisclosed function in the WSDL that has weak security controls and can accept custom content types...

The vulnerability of the public_website() function in the Hostinger plugin for WordPress content management systems allows attackers to increase their privileges.

The vulnerability of the publicwebsite function in the Hostinger content management system’s WordPress plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

PT-2024-12764 · Ibm · Ibm Openpages With Watson

Name of the Vulnerable Software and Affected Versions: IBM OpenPages with Watson versions 8.3 through 9.0 Description: The issue provides weaker than expected security in an OpenPages environment using Native authentication. An attacker with access to the OpenPages database could exploit this...

The vulnerabilities of microprogramming software in AMD, Qualcomm, and Imagination allow attackers to extract data from the local memory of GPUs.

The vulnerabilities of microprogramming software for AMD, Qualcomm, and Imagination relate to insufficient isolation of the GPU’s local memory, as well as the lack of cleanup after processes are executed on the GPU. Exploiting these vulnerabilities can allow attackers to extract data from the GPU...

Use Of Hard-Coded Credentials

@evershop/evershop is vulnerable to the Use Of Hard-Coded Credentials. The vulnerability is due to the exposure of a weak HMAC secret. Attackers can use the predictable secret to create valid JSON Web Tokens JWT, which allows them access to sensitive information...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2023-34058 DESCRIPTION: VMware Tools could allow a remote attacker to gain elevate...

The vulnerability of the /download.php?file=author.png file from the QR Code Generator allows a hacker to execute a cross-site scripting attack.

The vulnerability of the /download.php?file=author.png file, a QR Code Generator, exists due to the lack of security measures for website structures. Exploiting this vulnerability allows a remote attacker to carry out cross-site scripting attacks...

The vulnerability of the Redfish server of the MaxView Storage Manager allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the Redfish server of the MaxView Storage Manager relates to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the device...

PT-2024-5113 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The SolarWinds Access Rights Manager was found to have an authentication bypass issue, allowing an unauthenticated user to gain domain admin access within the Activ...

Dell iDRAC6 Improperly Implemented Security Check for Standard (CVE-2018-1243)

Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers t...

Security Bulletin: IBM OpenPages Is Vulnerable to Privilege Escalation attack (CVE-2023-38738)

Summary IBM OpenPages with Watson is affected by unauthorized account access due to Native authentication method. This vulnerability is addressed. Vulnerability Details CVEID:CVE-2023-38738 DESCRIPTION: IBM OpenPages could provide weaker than expected security in a OpenPages environment using...

CVE-2023-45237 Use of a Weak PseudoRandom Number Generator in EDK II Network Package

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...

CVE-2024-0556

A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text...