Filtered by CWE-311
Filtered by vendor Subscriptions
Total 459 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22948 1 Tigergraph 1 Tigergraph 2024-11-21 4.9 Medium
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph cluster.
CVE-2023-21404 1 Axis 1 Axis Os 2024-11-21 5.3 Medium
AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data.
CVE-2023-0750 1 Lynx-technik 2 Yellobrik Pec 1864, Yellobrik Pec 1864 Firmware 2024-11-21 9.8 Critical
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.  When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the password, resulting in a DOS of the users - Change the streaming source, compromising the integrity of the stream - Change the streaming destination, compromising the confidentiality of the stream This issue affects Yellowbrik: PEC 1864. No patch has been issued by the manufacturer as this model was discontinued.
CVE-2023-0690 1 Hashicorp 1 Boundary 2024-11-21 5 Medium
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk. This issue is fixed in version 0.12.0.
CVE-2022-4683 1 Usememos 1 Memos 2024-11-21 6.5 Medium
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
CVE-2022-4409 1 Phpmyfaq 1 Phpmyfaq 2024-11-21 7.5 High
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
CVE-2022-47715 1 Lastyard 1 Last Yard 2024-11-21 5.3 Medium
In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
CVE-2022-41627 1 Alivecor 6 Kardiamobile, Kardiamobile 6l, Kardiamobile 6l Firmware and 3 more 2024-11-21 4.8 Medium
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting sounds at similar frequencies as the device, disrupting the smartphone microphone’s ability to accurately read the data. To carry out this attack, the attacker must be close (less than 5 feet) to pick up and emit sound waves.
CVE-2022-40295 1 Phppointofsale 1 Php Point Of Sale 2024-11-21 4.9 Medium
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
CVE-2022-3781 1 Devolutions 2 Devolutions Server, Remote Desktop Manager 2024-11-21 6.5 Medium
Dashlane password and Keepass Server password in My Account Settings  are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions.
CVE-2022-3251 1 Ikus-soft 1 Minarca 2024-11-21 5.3 Medium
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2.
CVE-2022-3250 1 Ikus-soft 1 Rdiffweb 2024-11-21 5.3 Medium
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.
CVE-2022-3174 1 Ikus-soft 1 Rdiffweb 2024-11-21 7.5 High
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
CVE-2022-39014 1 Sap 1 Businessobjects Business Intelligence Platform 2024-11-21 5.3 Medium
Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted.
CVE-2022-38658 2 Hcltech, Microsoft 2 Bigfix Server Automation, Windows 2024-11-21 7.7 High
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
CVE-2022-38458 1 Netgear 2 Rbs750, Rbs750 Firmware 2024-11-21 6.5 Medium
A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information.
CVE-2022-38194 1 Esri 1 Portal For Arcgis 2024-11-21 6.7 Medium
In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
CVE-2022-35860 1 Corsair 2 K63, K63 Firmware 2024-11-21 6.8 Medium
Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions.
CVE-2022-34307 1 Ibm 1 Cics Tx 2024-11-21 4.3 Medium
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.
CVE-2022-33161 1 Ibm 4 Security Directory Integrator, Security Directory Server, Security Directory Suite and 1 more 2024-11-21 5.3 Medium
IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569.