The vulnerability of Google GRPC’s remote procedure call system lies in insufficient input validation and improper implementation of functions, allowing attackers to trigger service failures.

The vulnerability of Google GRPC process callouts is related to insufficient validation of input data and improper implementation of functions. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Socomec MODULYS GP Security Vulnerability

The Socomec MODULYS GP is a green power device from Socomec France. A security vulnerability exists in the Socomec MODULYS GP that stems from a lack of security in the authentication process, where information can be obtained by sending a number of requests in the web application of a vulnerable...

CVE-2023-34357

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

Default credentials

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

IBM: Jenkins server access due to weak password

Jenkins server access was gained due to a weak password. The issue was reported to IBM, analyzed, and remediated...

CVE-2023-34357 Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

CVE-2023-34357 Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has...

CVE-2023-34357

Soar Cloud Ltd. HR Portal is affected by CVE-2023-34357 due to a weak password recovery mechanism: the password-reset link sent by email remains valid after a reset and past its expiration, enabling an attacker who can access the link (e.g., via browser history) to reuse it and change the passwor...

The vulnerability of the application development environment and the Angular development platform, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to carry out XSS attacks.

The vulnerability of the application development environment and the Angular single-page application platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the JNDI component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows attackers to access, modify, add, or delete data.

The vulnerability of the JNDI component of Oracle Java SE and the Oracle GraalVM Enterprise Edition virtual machine is related to the use of insufficiently random values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to modify, add, or delete data...

PT-2023-24837 · Soar Cloud · Soar Cloud Ltd. Hr Portal

Name of the Vulnerable Software and Affected Versions: Soar Cloud Ltd. HR Portal affected versions not specified Description: The issue concerns a weak Password Recovery Mechanism for Forgotten Password in the Soar Cloud Ltd. HR Portal. The reset password link sent out through e-mail remains vali...

The vulnerability of the microprogramming software of the asynchronous server Moxa NPort 5600 is related to the use of cryptographic algorithms that contain vulnerabilities, allowing attackers to gain unauthorized access to the device.

The vulnerability of the microprogramming software of the asynchronous server Moxa NPort 5600 is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

CVE-2023-39981

A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker...

CVE-2023-39979

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values...

MOXA MXsecurity Security Feature Issue Vulnerability

MOXA MXsecurity is a management platform from China-based MOXA. that provides centralized visibility and security management to easily monitor and identify network threats and prevent security misconfigurations to create a robust threat defense. A security vulnerability exists in MOXA MXsecurity...

The vulnerability of the QTS operating system’s network storage solutions on QNAP devices allows a perpetrator to gain unauthorized access to confidential data.

The vulnerability of the QTS operating system’s network storage solutions from QNAP is related to insufficient encryption strength. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential data remotely...

KmsdBot Malware Gets an Upgrade: Now Targets IoT Devices with Enhanced Capabilities

An updated version of a botnet malware called KmsdBot is now targeting Internet of Things IoT devices, simultaneously branching out its capabilities and the attack surface. "The binary now includes support for Telnet scanning and support for more CPU architectures," Akamai security researcher Lar...

CVE-2023-26271

IBM Security Guardium Data Encryption IBM Guardium Cloud Key Manager GCKM 1.10.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 248126...

PT-2023-5689 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: HarmonyOS affected versions not specified Description: The issue is related to the use of a weak encryption mechanism when sending 5G messages in the SMS message module. This may allow a remote attacker to impact the confidentiality of...

CVE-2023-38730

IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 262268...