CVE-2017-11578: Exposure of Sensitive Information to an Unauthorized Actor

It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the...

GHSA-V33X-PRHC-GPH5 Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

D-Link Administrative Password Disclosure Vulnerability

D-Link models DIR-652, DIR-615, DIR-827, DIR-615, DIR-657, and DIR-825 suffer from an administrative password disclosure vulnerability. DLink Administrative Password Disclosure Vulnerability The problem in the following models : DIR-652 DIR-615 DIR-827 DIR-615 DIR-657 DIR-825 If login to web...

D-Link Administrative Password Disclosure

The problem in the following models : DIR-652 DIR-615 DIR-827 DIR-615 DIR-657 DIR-825 If login to web interface as "User" or "user" , and navigate to url : http://:port/wizardwan.asp in web code page: view-source::port/wizardwan.asp scroll down page and bang : administrator password in plain text...

ABB IDAL HTTP Server Authentication Bypass

XL-19-010 - ABB IDAL HTTP Server Authentication Bypass Vulnerability ======================================================================== Identifiers ----------- XL-19-010 CVE-2019-7226 ABBVU-IAMF-1902005 CVSS Score ---------- 8.8 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected vendor...

Design/Logic Flaw

IBM MQ Advanced Cloud Pak IBM Cloud Private 1.0.0 through 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465...

CVE-2019-4239

IBM MQ Advanced Cloud Pak IBM Cloud Private 1.0.0 through 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465...

CVE-2019-4239

IBM MQ Advanced Cloud Pak IBM Cloud Private 1.0.0 through 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465...

CVE-2019-4239

Summary: CVE-2019-4239 affects IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0–3.0.1). Affected systems store user credentials in plain text read-able by a local user. Impact (as stated): Local attacker could access plaintext credentials stored by the Cloud Pak deployment. Public metadata and ...

CVE-2019-4239: Insufficiently Protected Credentials

IBM MQ Advanced Cloud Pak IBM Cloud Private 1.0.0 through 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465...

GHSA-JWGX-9MMH-684W Credential exposure through log files in Undertow

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

Credential exposure through log files in Undertow

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

DEBIAN-CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

Design/Logic Flaw

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

UBUNTU-CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-3888

CVE-2019-3888 describes an information exposure in Undertow prior to 2.0.21 where Connectors.executeRootHandler logs the HttpServerExchange object at ERROR level via UndertowLogger.REQUEST_LOGGER.undertowRequestFailed, potentially exposing plain text credentials in log files. Connected documents ...