Archive
1 February 2024
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Critical 9.8
Use of Hard-Coded Credentials in Rapid SCADA
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specific port.
-
Critical 10.0
MachineSense FeverWarn Missing Authentication for Critical Function
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.
-
Critical 9.1
MachineSense FeverWarn Use of Hard-coded Credentials
Multiple MachineSense devices have credentials unable to be changed by the user or administrator.
-
Critical 9.8
Cryptographically weak PRNG in Opinio 7.22
Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.
-
Critical 9.8
Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER
Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.
-
Critical 9.1
OpenEXR Heap Overflow in Scanline Deep Data Parsing
Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This …
-
Critical 9.8
Vyper bounds check on built-in `slice()` function can be overflowed
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function us…
-
Critical 9.4
Mastodon Remote user impersonation and takeover
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Masto…
-
Critical 9.1
The Dataease datasource exists deserialization and arbitrary file read vulnerability
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dat…
-
Critical 9.8
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via th…