Fortinet FortiNAC 授权问题漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. A security vulnerability exists in Fortinet FortiNAC that stems from a weak authentication vulnerability in the device...

CVE-2023-26089

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...

Authentication flaw

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...

Weak Password Requirements

modoboa has Weak Password Requirements. The vulnerability exists in the clean function of forms.py due to lack of check conditions which allows an attacker to set unsafe passwords and bypass the password requirements...

CVE-2023-26089

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...

PT-2023-20479 · European Chemicals Agency · Iuclid

Name of the Vulnerable Software and Affected Versions: European Chemicals Agency IUCLID versions 5.15.0 through 6.27.5 Description: The issue allows authentication bypass due to a weak hard-coded secret used for JWT signing. Recommendations: For versions 5.15.0 through 6.27.5, update to version...

CVE-2023-2418

A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The...

CVE-2023-30466

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a...

CVE-2023-30466

CVE-2023-30466 affects Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG/E/T/H/C). The root cause is a weak password-reset mechanism in the NVR web-based management interface, enabling a remote attacker to perform account takeover via specially crafted HTTP requests. The connected sources provid...

CVE-2023-30466 Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a...

CVE-2023-27557

IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM...

Design/Logic Flaw

IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM...

CVE-2023-27557 IBM Safter Payments information disclosure

IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM...

IBM Safer Payments 加密问题漏洞

IBM Safer Payments is the first true payment processing cognitive fraud prevention solution from IBM USA. helps clients create customized, user-friendly decision models. IBM Safer Payments has a cryptographic issue vulnerability that stems from the use of weaker-than-expected encryption algorithm...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to execute arbitrary code.

The vulnerability of cloud-based software for creating and using Nextcloud data storage solutions is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system remotely...

The vulnerability of the web interface of the microprogramming software for the Distribution Power Unit (PDU) Aten PE8108, which allows a hacker to gain access to the account data via Telnet and SNMP.

The vulnerability of the web interface of the microprogramming software for the Distribution Processing Unit PDU Aten PE8108 is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the registration data...

Weak Password policy on account registration

Description It was observed that application allows to create account with Blank spaces as password Proof of Concept 1. Go to https://meta.answer.dev/users/register 2. Create account with 10 blank spaces as password Result: Application allows to create user account with blank spaces as password...

Weak Password Requirements

calibreweb is vulnerable to Weak Password Requirements. The vulnerability exists in the generaterandompassword function of helper.py, which allows users to create weak passwords resulting in account takeovers via bruteforce attacks...

APT28’s SNMP Attack on Cisco Routers

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT28 used SNMP access to exploit Cisco routers and gain network access, utilizing weak SNMP community strings and exploiting a vulnerability to deploy Jaguar Tooth. To receive real-time threat advisorie...