CVE-2014-2212

POSH (POSH portal / Portaneo) is affected by multiple CVEs in 2014. CVE-2014-2211 describes an SQL injection in portal/addtoapplication.php via the rssurl parameter, enabling remote arbitrary SQL execution for POSH versions 3.0 before 3.3.0. CVE-2014-2212 reports a separate issue where the rememb...

Canon PIXMA MX722 Printer Wireless Password Disclosure

Affects: Canon PIXMA MX722 Printer and probably other Canon printers. After typing my WPA2 WiFi password into the printer through the built-in hardware keypad, it exposes the cleartext password to the LAN through an admin page that isn't password protected:...

CVE-2013-5445

IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows local users to obtain sensitive cleartext information by leveraging knowledge of a static decryption key...

CVE-2014-2567

The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a 1 sent or 2 draft folder via a PREAUTH response that prevents later use of the STARTTLS comman...

Command injection

The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a 1 sent or 2 draft folder via a PREAUTH response that prevents later use of the STARTTLS comman...

CVE-2014-2567

The vulnerability CVE-2014-2567 affects Trojita prior to 0.4.1. The issue is in OpenConnectionTask::handleStateHelper in Trojita’s IMAP code, where a PREAUTH response can be exploited by a man-in-the-middle to force saving a message into the sent or draft folder over plaintext, bypassing STARTTLS...

Mandriva Linux Security Advisory : imapsync (MDVSA-2014:060)

Updated imapsync package fixes security vulnerabilities : Imapsync, by default, runs a release check when executed, which causes imapsync to connect to http://imapsync.lamiral.info and send information about the version of imapsync, the operating system and perl CVE-2013-4279. The imapsync packag...

CVE-2014-0694

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

Design/Logic Flaw

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

CVE-2014-0694

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

CVE-2014-0694

Cisco Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier contains fixed cryptographic material in binary files, enabling remote attackers to obtain cleartext data from any IAC installation with knowledge of the embedded key. Impact is confidential data leakage due to c...

Apple TV Touch Password Disclosure

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Intrepidus Group Security Advisory http://www.intrepidusgroup.com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Title: Apple TV Touch Setup Wi-Fi and iTunes Password Disclosure Release Date: 10 March...

CVE-2014-0890

The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony..level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by...

MGASA-2014-0106 Updated imapsync package fixes CVE-2014-2014

Updated imapsync package fixes security vulnerability: In imapsync before 1.584, a certificate verification failure when using the --tls option results in imapsync attempting a cleartext login CVE-2014-2014...

CVE-2014-1467

BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise...

Design/Logic Flaw

BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise...

CVE-2014-1467

The CVE-2014-1467 entry describes a vulnerability where several BlackBerry products (BlackBerry Enterprise Service 10 before 10.2.1; Universal Device Service 6; Enterprise Server Express for Domino/Exchange/GroupWise up to indicated MR/5.0.4) log cleartext credentials during exception handling. T...

CVE-2014-1467

BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise...

GLSA-201402-12 : PAM S/Key: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201402-12 PAM S/Key: Information disclosure Ulrich Mller reported that a Gentoo patch to PAM S/Key does not remove credentials provided by the user from memory. Impact : A local attacker with privileged access could inspect a memo...

Default credentials

Spacewalk-backend in Red Hat Network RHN Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading 1 the server log and 2 an email...