CVE-2022-34385: Inadequate Encryption Strength

SupportAssist for Home PCs version 3.11.4 and prior and SupportAssist for Business PCs version 3.2.0 and prior contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information...

CVE-2022-33233 Configuration weakness in modem

Memory corruption due to configuration weakness in modem wile sending command to write protected files...

CVE-2022-33233: Out-of-bounds Write

Memory corruption due to configuration weakness in modem wile sending command to write protected files...

PT-2023-13254 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to memory corruption caused by a configuration weakness in the modem when sending commands to write protected files. Recommendations: At the moment, there is no informati...

AMI MegaRAC Unauthorized Access

The vulnerability of the application software interface for AMI MegaRAC controllers is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

plugin: Lack of authentication mechanism in Git Plugin webhook

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions

A flaw was found in the script-security Jenkins Plugin. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. The affected version of the script-security Plugin stores whole-script approvals as the SHA-1 hash of the approved script...

TP-Link SG105PE Authentication Bypass

The vulnerability of TP-Link SG105PE switch’s microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...

CVE-2023-24029

In Progress WSFTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows...

Progress Software WS_FTP Server security vulnerabilities

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, USA. A security vulnerability exists in Progress Software WSFTP Server that stems from insufficient authorization controls over user modifications to the workflow application, where host...

Passwords Are Terrible (Surprising No One)

This is the result of a security audit: More than a fifth of the passwords protecting network accounts at the US Department of the Interior--including Password1234, Password1234!, and ChangeItN0w!--were weak enough to be cracked using standard methods, a recently published security audit of the...

UI Desktop Access Control Command Execution

The vulnerability of the UI Desktop software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

Efence SQL injection vulnerability

Thinking Software Technology Efence is a mobile device management solution from China-based Thinking Software Technology. A SQL injection vulnerability exists in Efence 1.2.58 DB.ver 28, which stems from insufficient validation of user input in the login function. An attacker could use this...

MySQL Server InnoDB DoS

The vulnerability of the InnoDB component in the MySQL Database Management System is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Design/Logic Flaw

IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078...

IBM Security Verify Governance encryption issue vulnerability

IBM Security Verify Governance, an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risks. IBM Security Verify Governanc has an encryption issue vulnerability that stems...

IBM WebSphere Application Server encryption issue vulnerabilities

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. IBM WebSphere Application Server versions 8.5 and 9.0 ha...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

Security feature bypass

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

Cisco IP Phones Web Interface Privilege Escalation

The vulnerability of the web interface of Cisco IP Phones 7800 and 8800 microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow unauthorized actors to gain unauthorized access to protected information and increase their privileges...