Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
307 results · page 3 of 7
May 1, 2025Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the CVE-2025-46633 · Network & remote access · Tenda · reported by MITREHigh 8.2
Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AES key in sent in cleartext in response to successful authentication. The IV is always EU5H62G9ICGRNI43.
- Product
- Rx2 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.uturn.devtendacn.com
Apr 23, 2025This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints.CVE-2025-42603 · Other software · Meon · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users. Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.
- Product
- KYC solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possibleCVE-2025-43013 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'.CVE-2025-27722 · Other software · Inaba Denki Sangyo Co., Ltd. · reported by vultures@jpcert.or.jpMedium 5.9
Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote unauthenticated attacker to eavesdrop the communication and obtain the authentication information.
- Product
- AC-WPS-11ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission ofCVE-2023-52941 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the two above functionalities with separate timer callbacks. The two simplified timers now run in one-shot mode and make the state transitions (especially with isotp_rcv_echo) better understandable.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 20, 2025Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information TecCVE-2025-2311 · Other software · Sechard Information Technologies · reported by iletisim@usom.gov.trCritical 9
Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.
- Product
- SecHard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 18, 2025Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified CVE-2024-10442 · Network & remote access · Synology · reported by security@synology.comCritical 10
Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors.
- Product
- Unified Controller (DSMUC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed byCVE-2025-1060 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker.
- Product
- ASCO 5310 Single-Channel Remote Annunciator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Feb 6, 2025Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encCVE-2024-36558 · Other software · reported by MITREHigh 7.5
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidenCVE-2024-12399 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.1
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication.
- Product
- Pro-face GP-Pro EX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 15, 2025Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows DirecCVE-2025-0502 · Other software · CrafterCMS · reported by security@craftersoftware.comMedium 6.9
Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6.
- Product
- CrafterCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability.CVE-2024-42181 · Other software · HCL Software · reported by psirt@hcl.comLow 1.6
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Dec 30, 2024iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability.CVE-2024-11946 · Other software · iXsystems · reported by zdi-disclosures@trendmicro.comMedium 6.5
iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the use of an insecure protocol to deliver updates. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-25668.
- Product
- TrueNAS CORE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtruenas.comzerodayinitiative.com
Nov 13, 2024Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentialCVE-2024-28169 · Other software · reported by secure@intel.comMedium 4.3
Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable denial of service via adjacent access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password haCVE-2024-8933 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.
- Product
- Modicon M340 CPU (part numbers BMXP34*)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Nov 4, 2024gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission.CVE-2024-48059 · Other software · gaizhenbiao · reported by MITREMedium 6.1
gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's browser.
- Product
- gaizhenbiao\/chuanhuchatgpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comrumbling-slice-eb0.notion.site
Oct 15, 2024Cleartext transmission of sensitive information in acep-collector service.CVE-2024-49387 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
- Product
- Acronis Cyber Protect 16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Oct 7, 2024Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.CVE-2024-33069 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints.CVE-2024-45787 · Other software · Reedos Software Solutions · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the API request leading to exposure of sensitive information belonging to other users.
- Product
- Mutual Fund Distribution Product (aiM-Star)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authentiCVE-2024-44105 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.2
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2024Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs.CVE-2024-41927 · Other software · IDEC Corporation · reported by vultures@jpcert.or.jpMedium 4.6
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.
- Product
- FC6A Series MICROSmart All-in-One CPU module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode.CVE-2024-7408 · Other software · Airveda · reported by vdisclose@cert-in.org.inHigh 8.6
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this vulnerability could allow the attacker to cause Evil Twin attack on the targeted system.
- Product
- Air Quality Monitor PM2.5 PM10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text.CVE-2024-41687 · Other software · SyroTech · reported by vdisclose@cert-in.org.inHigh 8.6
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerability by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
- Product
- SyroTech SY-GPON-1110-WDONT router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
May 29, 2024When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or gCVE-2024-34161 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
May 14, 2024NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information issCVE-2024-0098 · Other software · nvidia · reported by psirt@nvidia.comMedium 5.5
NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information issue by data sniffing. A successful exploit of this vulnerability might lead to information disclosure.
- Product
- ChatRTX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 22, 2024A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexsCVE-2024-31036 · Other software · nanomq · reported by MITREMedium 6.8
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexstreams.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability.CVE-2024-25960 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sk_forward_memory corruption on retransmission MPTCP sk_forward_memory handlingCVE-2021-47132 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sk_forward_memory corruption on retransmission MPTCP sk_forward_memory handling is a bit special, as such field is protected by the msk socket spin_lock, instead of the plain socket lock. Currently we have a code path updating such field without handling the relevant lock: __mptcp_retrans() -> __mptcp_clean_una_wakeup() Several helpers in __mptcp_clean_una_wakeup() will update sk_forward_alloc, possibly causing such field corruption, as reported by Matthieu. Address the issue providing and using a new variant of blamed function which explicitly acquires the msk spin lock.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 14, 2024 The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft CVE-2024-0860 · Other software · Softing · reported by ics-cert@hq.dhs.govHigh 8
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
- Product
- edgeConnector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2024IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow aCVE-2023-27291 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.5
IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information. IBM X-Force ID: 248740.
- Product
- Watson CP4D Data Stores
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 14, 2024 CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service andCVE-2023-6408 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.1
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack.
- Product
- Modicon M340 CPU (part numbers BMXP34*)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Feb 6, 2024An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets.CVE-2024-22520 · Other software · Dronetag · reported by MITREHigh 8.2
An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets.
- Product
- Drone Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.CVE-2024-22519 · Other software · Sorenfriis · reported by MITREHigh 8.2
An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.
- Product
- Opendroneid OSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information.CVE-2023-46889 · Other software · Meross · reported by MITREMedium 5.7
Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to connect to the Internet through a Wi-Fi router. This is why MSH30Q asks for the Wi-Fi network name (SSID) and the Wi-Fi network password. When the user enters the password, the transmission of the Wi-Fi password and name between the MSH30Q and mobile application is observed in the Wi-Fi network. Although the Wi-Fi password is encrypted, a part of the decryption algorithm is public so we complemented the missing parts to decrypt it.
- Product
- Msh30q Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2024Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.CVE-2023-42144 · Other software · Shelly · reported by MITREMedium 5.5
Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.
- Product
- TRV Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2024This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network.CVE-2023-51741 · Other software · Hathway · reported by vdisclose@cert-in.org.inHigh 7.5
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extract username and password from the web interface (Password Reset Page) of the vulnerable targeted system.
- Product
- Skyworth Router CM5100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
Jan 17, 2024This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network.CVE-2023-51740 · Other software · Hathway · reported by vdisclose@cert-in.org.inHigh 7.5
This vulnerability exist in Skyworth Router CM5100, version 4.1.1.24, due to transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this vulnerability by eavesdropping on the victim’s network traffic to extract username and password from the web interface (Login Page) of the vulnerable targeted system.
- Product
- Skyworth Router CM5100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
Nov 28, 2023The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validCVE-2023-29062 · Other software · Becton, Dickinson and Company (BD) · reported by cybersecurity@bd.comLow 3.8
The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.
- Product
- FACSChorus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023 Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the CVE-2023-5777 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 9.8
Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.
- Product
- EasyBuilder Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2023IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission.CVE-2023-33837 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.1
IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020.
- Product
- Security Verify Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 19, 2023 The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to theCVE-2023-41088 · Other software · DEXMA · reported by ics-cert@hq.dhs.govMedium 6.3
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker with access to the network, where clients have access to the DexGate server, could capture traffic. The attacker can later us the information within it to access the application.
- Product
- DexGate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023 Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to stealCVE-2023-34441 · Other software · Baker Hughes - Bently Nevada · reported by ics-cert@hq.dhs.govMedium 6.8
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.
- Product
- Bently Nevada 3500 System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023 IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text.CVE-2022-22385 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force ID: 221962.
- Product
- Security Verify Privilege
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 12, 2023Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.CVE-2023-5554 · Other software · LINE Corporation · reported by dl_cve@linecorp.comMedium 4.8
Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.
- Product
- LINE client for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 9, 2023 Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via CVE-2023-5100 · Other software · SICK AG · reported by psirt@sick.deMedium 5.9
Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitive information via intercepting network traffic that is not encrypted.
- Product
- APU0200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client.CVE-2023-23371 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.2
A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.2.0.0823 and later
- Product
- QVPN Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems.CVE-2023-34972 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.5
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the CVE-2023-38433 · Other software · Fujitsu Limited · reported by vultures@jpcert.or.jpHigh 7.5
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.
- Product
- IP-HE950E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host DatCVE-2023-34142 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9
Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device Manager: before 8.8.5-02.
- Product
- Hitachi Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
Jul 10, 2023Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffCVE-2023-3272 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
Cleartext Transmission of Sensitive Information in the SICK ICR890-4 could allow a remote attacker to gather sensitive information by intercepting network traffic that is not encrypted.
- Product
- ICR890-4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.