CVE-2019-4668

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

Code injection

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

CVE-2019-4668

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

CVE-2019-4668

CVE-2019-4668 affects IBM UrbanCode Deploy (UCD). The connected IBM security bulletin and NVD entry confirm that UCD stores user credentials in plaintext, readable by a local user, due to improper credential storage. Impact is confidentiality loss for credentials; exploitability is local. Remedia...

PT-2020-11012

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy UCD version 7.0.4.0 Description The issue allows a local user to read user credentials stored in plain text. Recommendations For IBM UrbanCode Deploy UCD version 7.0.4.0, consider restricting access to sensitive areas wher...

CVE-2019-19105 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentials

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...

SMACom 1.2.0 Insecure Transit / Password Disclosure

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-16 Vulnerability Laboratory ID VL-ID: ====================================...

Credentials stored in plain text by copr

copr 0.3 and earlier stores credentials unencrypted in job config.xml files as part of its configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. copr 0.6.1 stores these credentials encrypted. This change is effective...

Continued Exploitation of Pulse Secure VPN Vulnerability

Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix an arbitrary file reading vulnerability, known as CVE-2019-11510, can become compromised in an attack. 1 Although Pulse Secur...

SMACom v1.2.0 - Insecure Session Validation Vulnerability

Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID: ====================================...

Information Disclosure

jboss is vulnerable to information disclosure. The vulnerability exists as JMX password was logged in plain text to "twiddle.log"...

CVE-2020-10267

Universal Robots control box CB 3.1 across firmware versions tested on 1.12.1, 1.12, 1.11 and 1.10 does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components URCaps. These files .urcaps are stored under...

CVE-2020-10267: Missing Encryption of Sensitive Data

Universal Robots control box CB 3.1 across firmware versions tested on 1.12.1, 1.12, 1.11 and 1.10 does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components URCaps. These files .urcaps are stored under...

AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)

Exploit Title: AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow SEH Date: 2020-04-02 Exploit Author: Hodorsec Version: v6.20.5300 Software Link: http://download.aida64.com/aida64engineer620.exe Vendor Homepage: https://www.aida64.com/products/aida64-engineer Tested on: Win7 x86...

EulerOS Virtualization for ARM 64 3.0.6.0 : keepalived (EulerOS-SA-2020-1357)

According to the versions of the keepalived package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2020-2165

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2165

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

Code injection

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2165

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...