4793 matches found
Dell Data Protection Central 加密问题漏洞
Dell Data Protection Central is a suite of data protection solutions from Dell USA. The product provides single sign-on, dashboards, and system monitoring. A vulnerability exists in Dell Data Protection Central version 19.9 due to an encryption issue that stems from insufficient encryption...
PT-2023-28370 · Unknown · Soundminer
Name of the Vulnerable Software and Affected Versions: Soundminer affected versions not specified Description: The issue is related to improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This is a type of security weakness that can allow an attacker to...
CVE-2023-43637 Vault Key Partially Predetermined
Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" which will always return "foobarfoobarfoobarfoobarfoobarfo...
PT-2023-28893
Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 7.10 Description The issue arises from the implementation of deriveVaultKey, which generates a vault key with the last 16 bytes predetermined to be "arfoobarfoobarfo". This occurs because deriveVaultKey calls...
The vulnerability of the software for exchanging information and events between components of the IBM Security Verify Information Queue authentication and authorization system, related to deficiencies in the error reporting mechanism, allows a perpetrator to gain access to confidential information.
The vulnerability of the information and event exchange software between the components of the IBM Security Verify Information Queue authentication and authorization system is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability could allow a malicious actor,...
Weak Password Vulnerability in Marcum Database Auditing System of Shenzhen Marcum Technology Co.
Marcum Database Security Audit System mainly realizes visualized monitoring, analysis and summarization of users' access to database operation behaviors, providing users with electronic evidence for tracing back the root cause of accidents, and at the same time, providing efficient querying of...
Design/Logic Flaw
UNSUPPPORTED WHEN ASSIGNED Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the we...
CVE-2023-41965
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process...
CVE-2023-39446 Socomec MOD3GP-SY-120K Cross-Site Request Forgery
Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application...
The vulnerability of the ProjectInstance class in the Microsoft Exchange Server mail server allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the ProjectInstance class in Microsoft Exchange Server involves deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation
A high-severity security flaw has been disclosed in N-Able's Take Control Agent that could be exploited by a local unprivileged attacker to gain SYSTEM privileges. Tracked as CVE-2023-27470 CVSS score: 8.8, the issue relates to a Time-of-Check to Time-of-Use TOCTOU race condition vulnerability,...
Siemens RUGGEDCOM ROX Inadequate Encryption Strength (CVE-2023-36748)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...
The vulnerability of the Crucible code-checking tool and the Fisheye code-searching tool lies in the insufficient protection of operational data, allowing unauthorized access by attackers to protected information.
The vulnerability of the Crucible code-checking tool and the Fisheye code-searching tool is related to insufficient protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the CMPappBP component in CODESYS software products allows a hacker to trigger a service failure.
The vulnerability of the CMPappBP component in CODESYS software products is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
PT-2023-5053 · Microsoft · Exchange Server
Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of the Microsoft Exchange Server, allowing a remote attacker to conduct spoofing attacks. This can...
PT-2023-5032 · Microsoft · Windows Kernel +1
Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel, which is associated with insufficient access control. This vulnerability can be exploited to...
CVE-2023-4898 Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1...
CVE-2023-4898 Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1...
OESA-2023-1609 hyperscan security update
Hyperscan is a high-performance multiple regex matching library. It follows the regular expression syntax of the commonly-used libpcre library, but is a standalone library with its own C API. Security Fixes: Insufficient control flow management in the Hyperscan Library maintained by IntelR before...
