SUSE-SU-2021:2439-1 Security update for curl

This update for curl fixes the following issues: - CVE-2021-22925: TELNET stack contents disclosure again. bsc1188220 - CVE-2021-22924: Bad connection reuse due to flawed path name checks. bsc1188219 - CVE-2021-22923: Insufficiently Protected Credentials. bsc1188218 - CVE-2021-22922: Wrong conten...

CVE-2021-22780

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

Schneider Electric EcoStruxure Geo SCADA Expert License Issue Vulnerability

Schneider Electric EcoStruxure Geo SCADA Expert ClearSCADA is a suite of data acquisition and monitoring software SCADA from Schneider Electric, France. EcoStruxure Geo SCADA Expert 2019 has a security vulnerability that stems from insufficient credential protection, which could result in risk...

Cyberark Software Endpoint Privilege Manager Code Issue Vulnerability

Cyberark Software CyberArk Software Endpoint Privilege Manager formerly Viewfinity is a privilege management software from CyberArk Software Cyberark Software, Israel. The software includes features such as privilege management, application control, and credential loss protection. A security...

CVE-2020-26079

A vulnerability in the web UI of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by...

Design/Logic Flaw

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

Micro Focus Enterprise Server and Enterprise Developer Insufficient Credential Protection Vulnerability

Micro Focus Enterprise Server and Micro Focus Enterprise Developer are both products of Micro Focus, a British company.Micro Focus Enterprise Server is an enterprise server. Micro Focus Enterprise Server is an enterprise server that provides a deployment environment for mainframe applications.Mic...

Barco ClickShare Button R9861500D01 Insufficient Credential Protection Vulnerability

The Barco ClickShare Button R9861500D01 is a wireless control device for presentation systems from Barco Belgium. An insufficiently protected credentials vulnerability exists in Barco ClickShare Button R9861500D01 prior to version 1.9.0, which can be exploited by an attacker to obtain the identit...

thesystem App 1.0 - (username) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: thesystem App 1.0 - 'username' SQL Injection Author: Anıl Baran Yelken Vendor Homepage: https://github.com/kostasmitroglou/thesystem Software Link: https://github.com/kostasmitroglou/thesystem Tested Version: 1.0 Tested on OS:...

CVE-2019-8352

Technical details of CVE-2019-8352 are not publicly provided in the supplied connected documents. Monitor for updates from Vulners and official advisories.

CyberArk Enterprise Password Vault 10.7 XML External Entity Injection

Exploit Title: CyberArk XML External Entity XXE Injection in SAML authentication Date: 10/05/2019 Exploit Author: Marcelo Toran @spamv Vendor Homepage: https://www.cyberark.com Version: =10.7 CVE : CVE-2019-7442 -----------Product description The CyberArk Enterprise Password Vault is a privileged...

Design/Logic Flaw

Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers under the same user context to obtain cleartext credentials of the stored account...

CVE-2019-10239

Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers under the same user context to obtain cleartext credentials of the stored account...

Microsoft Windows: Turn On Virtualization Based Security (Credential Guard Configuration)

Specifies whether Virtualization Based Security is enabled. Virtualization Based Security uses the Windows Hypervisor to provide support for security services. Virtualization Based Security requires Secure Boot, and can optionally be enabled with the use of DMA Protections. DMA protections requir...

CloudBees Jenkins AWS CodePipeline Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . AWS CodePipeline Plugin is used in o...

Insufficiently Protected Credentials

The Jenkins AWS CodeDeploy Plugin does not properly protect credentials in AWSCodeDeployPublisher...

PT-2017-7553

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions 11 through 12.2 Description The issue concerns the custom encryption algorithm used to protect credentials for accessing monitored devices. This algorithm lacks a per-system key or salt, making it possible ...

CVE-2016-8378

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials...

ABB PCM600 Credential Protection Vulnerability (CNVD-2016-03751)

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. The ABB PCM600 master application password is not properly saved after it has been changed. A local attacker could exploit this vulnerability to access the affected device...

Rockwell RSLogix 5000 Password Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on January 21, 2014, and is now being released to the NCCIC/ICS-CERT Web site. Independent researcher Stephen Dunlap has identified a password vulnerability in the Rockwell Automation RSLogix 5000 software. Rockwell...