CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-49107 – Generation of Error Message Containing Sensitive Information Vulnerability in Hitachi Device Manager
https://notcve.org/view.php?id=CVE-2023-49107
Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issue affects Hitachi Device Manager: before 8.8.5-04. Vulnerabilidad de generación de mensaje de error que contiene información confidencial en Hitachi Device Manager en Windows, Linux (módulos Device Manager Agent). Este problema afecta a Hitachi Device Manager: versiones anteriores a 8.8.5-04. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-101/index.html • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-49106 – Missing Password Field Masking Vulnerability in Hitachi Device Manager
https://notcve.org/view.php?id=CVE-2023-49106
Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Manager: before 8.8.5-04. Vulnerabilidad de enmascaramiento de campo de contraseña faltante en Hitachi Device Manager en Windows, Linux (componente Device Manager Agent). Este problema afecta a Hitachi Device Manager: versiones anteriores a 8.8.5-04. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-101/index.html • CWE-522: Insufficiently Protected Credentials CWE-549: Missing Password Field Masking •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50916
https://notcve.org/view.php?id=CVE-2023-50916
Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a \ (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. • https://www.kyoceradocumentsolutions.us/en/about-us/pr-and-award-certifications/press/kyocera-device-manager-cve-2023-50196-vulnerability-solution-update.html https://www.trustwave.com/en-us/resources/security-resources/security-advisories https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-001_kyocera-v2.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34143 – Improper Validation of Certificate Vulnerability in Hitachi Device Manager
https://notcve.org/view.php?id=CVE-2023-34143
Improper Validation of Certificate with Host Mismatch vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Man in the Middle Attack.This issue affects Hitachi Device Manager: before 8.8.5-02. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html • CWE-295: Improper Certificate Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34142 – Cleartext Transmission Vulnerability in Hitachi Device Manager
https://notcve.org/view.php?id=CVE-2023-34142
Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device Manager: before 8.8.5-02. • https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-125/index.html • CWE-319: Cleartext Transmission of Sensitive Information •