PT-2023-21487 · Ibm · Bigfix Webui

Name of the Vulnerable Software and Affected Versions: BigFix WebUI affected versions not specified Description: The issue concerns the use of weak cipher suites by the BigFix WebUI. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CVE-2023-28021: Inadequate Encryption Strength

The BigFix WebUI uses weak cipher suites...

PT-2023-21486 · Hcl · Hcl Bigfix Webui

Name of the Vulnerable Software and Affected Versions: HCL BigFix WebUI affected versions not specified Description: The issue allows a malicious user to redirect the client browser to an external site via a redirect URL response header in the login page. Recommendations: At the moment, there is ...

CVE-2023-28019: Improper Neutralization of Special Elements used in an SQL Command

Insufficient validation in Bigfix WebUI API App site version 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query...

CVE-2023-28023: Cross-Site Request Forgery (CSRF)

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems server machine and all the ones in its network...

MAL-2023-694 Malicious code in presto-webui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc84a4fe2d659dd1d6ab8f160c0c7c4a5f1920b754c9be7cccae485027e209e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in presto-webui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-23344

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page...

Code injection

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page...

CVE-2023-23344 HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page...

CVE-2023-23344

CVE-2023-23344 affects HCL BigFix WebUI Insights, specifically site version 14. A permission issue allows an authenticated, unprivileged operator to access an administrator page. The security concerns are documented across multiple sources (NVD/NVD-enriched, CVE listings, and PT Security) and con...

CVE-2023-23344 HCL BigFix WebUI Insights is susceptible to a lack of sufficient authorization

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page...

PT-2023-18917 · Ibm · Bigfix Webui Insights

Name of the Vulnerable Software and Affected Versions: BigFix WebUI Insights site version 14 Description: A permission issue allows an authenticated, unprivileged operator to access an administrator page. Recommendations: For BigFix WebUI Insights site version 14, update to a version that fixes t...

CVE-2023-23344: Incorrect Default Permissions

A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page...

CVE-2022-46165

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

Cross site scripting

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

CVE-2022-46165

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

CVE-2022-46165

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

CVE-2022-46165: Improper Neutralization of Input During Web Page Generation

Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and...

CVE-2023-25184

Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASI...