Vulnerabilities (CVE)

Filtered by CWE-319
Total 709 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-43180 1 Ibm 1 Concert 2024-09-20 N/A 4.3 MEDIUM
IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVE-2024-45101 2024-09-14 N/A 6.8 MEDIUM
A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL.
CVE-2024-8059 2024-09-14 N/A 4.3 MEDIUM
IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.
CVE-2024-38891 1 Horizoncloud 1 Caterease 2024-08-20 N/A 7.5 HIGH
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information.
CVE-2024-38167 1 Microsoft 2 .net, Visual Studio 2022 2024-08-16 N/A 6.5 MEDIUM
.NET and Visual Studio Information Disclosure Vulnerability
CVE-2024-31799 1 Gncchome 2 Gncc C2, Gncc C2 Firmware 2024-08-16 N/A 4.6 MEDIUM
Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Port.
CVE-2024-7408 1 Airveda 2 Pm2.5 Pm10 Monitor, Pm2.5 Pm10 Monitor Firmware 2024-08-13 N/A 6.5 MEDIUM
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this vulnerability could allow the attacker to cause Evil Twin attack on the targeted system.
CVE-2024-32864 1 Johnsoncontrols 1 Exacqvision Web Service 2024-08-09 N/A 8.1 HIGH
Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)
CVE-2024-41262 2024-08-01 N/A 7.4 HIGH
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack.