Input validation

The Western Digital My Cloud Web App https://os5.mycloud.com/ uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to maintain compatibility with old or outdated home routers. By using an "SSL" context instead of "TLS" or specifying stronger validation,...

DEBIAN-CVE-2022-26307

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...

CVE-2022-26307

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...

UBUNTU-CVE-2022-26307

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...

LibreOffice 安全特征问题漏洞

LibreOffice is an open source office software suite from The Document Foundation tdf. The product includes applications such as Writer text documents, Calc spreadsheets, and Impress presentations.LibreOffice is vulnerable to an encryption problem that stems from LibreOffice using weak...

CVE-2022-31234

Dell EMC PowerStore, contains an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are...

CVE-2022-31234

Dell EMC PowerStore, contains an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are...

The vulnerability affects the service for managing container images on the analytics and automation platform for Cisco Nexus Dashboard. This allows a malicious actor to load arbitrary container images.

The vulnerability of the service responsible for managing container images on the analytics and automation platform for Cisco Nexus Data Center solutions is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to download arbitrary...

Wago IO 750-849 & 750-881 Weak Credential Management (CVE-2015-6472)

WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. C Tenable, Inc. include'compat.inc'; if description scriptid500680;...

CVE-2022-31234

Dell EMC PowerStore, contains an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are...

CVE-2022-24082

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running o...

How to ‘Win’ a Red Team Exercise

What is a red team exercise? Organizations that conduct red team exercises use penetration testing tactics to assess vulnerabilities and discover weak points in their cybersecurity preparation. Usually, this involves two teams - one red the protagonists and one blue the incident responders who mu...

Backdoor.Win32.HoneyPot.a MVID-2022-0622 Weak Hardcoded Password

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/e3bb503f9b02cf57341695f30e31128f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.HoneyPot.a Vulnerability: Weak Hardcoded Password Description: The malware...

Ambit Technologies iTech Job Portal Script 授权问题漏洞

Ambit Technologies iTech Job Portal Script is an efficient interactive platform from Ambit Technologies India. One can post their vacancy profile on one side and candidates can post their resume on the other side. Ambit Technologies iTech Job Portal Script version 9.13 suffers from a security...

CVE-2022-22453

IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 224919...

CVE-2022-22453

CVE-2022-22453 affects IBM Security Verify Identity Manager 10.0 (virtual appliance component). The root cause is the use of weaker-than-expected cryptographic algorithms, allowing an attacker to decrypt highly sensitive information (confidentiality impact). IBM’s bulletin references a CVSS base ...

IBM Security Verify Identity Manager 加密问题漏洞

IBM Security Verify Identity Manager is a security verification identity manager from IBM USA. A security vulnerability exists in IBM Security Verify Identity Manager version 10.0 that stems from the use of a weaker-than-expected encryption algorithm. An attacker could exploit the vulnerability t...

Siemens Mendix Access Control Error Vulnerability (CNVD-2022-51432)

Mendix is a high-productivity application platform that enables mobile and web applications to be built and continuously improved at scale. Siemens Mendix is vulnerable to an access control error that could be exploited by an attacker to set weak passwords...

Sage 300 代码问题漏洞

Sage 300 is a well-established closed-source enterprise resource planning ERP solution from Sage designed to facilitate business management. A security vulnerability exists in Sage 300 ERP version 6.8.x and prior versions, which stems from an inability to set explicit permissions, resulting in th...

CVE-2022-34757

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected communication details. Affected Products: Easergy P5 V01.401.1...