Design/Logic Flaw

Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...

CVE-2022-34615

Mealie 1.0.0beta3 is associated with multiple CVEs affecting authentication controls: CVE-2022-34615: weak password requirements enable brute-force attacks to potentially gain unauthorized access to the application. Root cause stated as insufficient password strength checks. CVE-2022-34621: an In...

CVE-2022-34615

Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...

CVE-2022-34615

Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by Hayden Individual Developers in the United States. A security vulnerability exists in Mealie version 1.0.0beta3, which stems from the use of weak passwords, allowing an attacker to gain unauthorized access to the application via a brute...

Softing smartLink SW-HT 安全漏洞

The Softing smartLink SW-HT is a HART multiplexer from Softing that provides simple and fast access to HART field devices without additional hardware. A security vulnerability exists in the Softing smartLink SW-HT that arises from enabling weak passwords during secure communications SSL...

CVE-2022-35198

Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...

CVE-2022-35198

Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...

CVE-2022-35198

Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...

PT-2022-22628 · Unknown · Contract Management System

Name of the Vulnerable Software and Affected Versions: Contract Management System version 2.0 Description: The issue is related to a weak default password in the Contract Management System, which allows attackers to access database connection information. Recommendations: For Contract Management...

Contract Management System 授权问题漏洞

Contract Management System is a contract management system. It enables companies to create new contracts and track the status of existing contracts to ensure that employees, vendors, and customers meet defined requirements. A security vulnerability exists in Contract Management System version v2....

The vulnerability in the implementation of the SSLContext class in My Cloud OS operating systems allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the SSLContext class implementation in My Cloud OS networking storage operating systems is related to the choice of a less secure algorithm during negotiation processes. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and...

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

The vulnerability of the PHP-Fusion CMS, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to carry out XSS attacks.

The vulnerability of the PHP-Fusion CMS exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2022-24271 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS version 10.8.1 Description: A system property in Esri Portal for ArcGIS is not properly encrypted, potentially allowing a local user to read sensitive information from a properties file. Recommendations: For Esri Portal...

Apache OpenOffice 安全特征问题特征问题漏洞

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases and more. A security feature issue vulnerability exists in Apache OpenOffice versions prior to 4.1.13, which stems...

The vulnerability of the SprdContactsProvider implementation in the Telephony component of Android operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SprdContactsProvider implementation in the Telephony component of Android operating systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, acting remotely, to gain unauthorized access to protected...

Vulnerabilities fixed in apache OpenOffice

Apache Software Foundation has fixed vulnerabilities in OpenOffice. The vulnerabilities allow a malicious person with access to the system to retrieve user passwords stored in a user's configuration database. The vulnerabilities involve weak encryption on this configuration database. Apache has...

CVE-2022-37401 Apache OpenOffice Weak Master Keys

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from...

No rate limit on main Login page lead to account takeover

Hi Team, Summary: As a best practice a login page should have a rate limit to avoid any kind of brute force. Aslo The password policy used in the account creation and password change pages is weak, allowing to set a password of only 1 character...