Credentials Exposure

github.com/argoproj/argo-cd is vulnerable to Credentials Exposure. The vulnerability is due to the inappropriate handling and logging of sensitive authentication information within pod logs when connected to a Helm OCI repository with authentication enabled, allows individuals with access to the...

PT-2024-30674 · Kieback & Peter · Kieback & Peter'S Ddc4000 Series

Name of the Vulnerable Software and Affected Versions: Kieback & Peter's DDC4000 series affected versions not specified Description: The issue is related to insufficiently protected credentials, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of...

HMS EWON FLEXY 202 安全漏洞

HMS EWON FLEXY 202 is a multi-purpose IIoT data gateway from HMS Sweden. Allows machine builders and users to monitor and collect important KPIs for analysis and predictive maintenance. A security vulnerability exists in HMS EWON FLEXY 202 version 14.2s0 that stems from the use of the weak encodi...

PT-2024-7336 · Cisco · Cisco Ucs Central

Name of the Vulnerable Software and Affected Versions: Cisco UCS Central Software affected versions not specified Description: A weakness in the encryption method used for the backup function in Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive...

CVE-2024-9465

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

PT-2024-6886

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition. This result...

CVE-2024-8884

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attacker has access to application on network over http...

D3D Security IP Camera 安全漏洞

D3D Security IP Camera is a series of cameras from D3D Security. A security vulnerability exists in D3D Security IP Camera that stems from a weak authentication scheme used by the HTTP header protocol, resulting in the exposure of user credentials on the target device...

CVE-2023-46175

IBM Cloud Pak for Multicloud Management 2.3 through 2.3 FP8 stores user credentials in a log file plain clear text which can be read by a privileged user...

Synology Active Backup for Business Agent 安全漏洞

Synology Active Backup for Business Agent is a backup program from China-based Synology Inc. A security vulnerability exists in Synology Active Backup for Business Agent prior to version 2.7.0-3221, which stems from a lack of sensitive data encryption vulnerability in the Settings feature that...

Credentials Exposure

github.com/grafana/grafana-plugin-sdk-go is vulnerable to Credentials Exposure. The vulnerability is due to the inclusion of the full repository URI, including credentials, in the metadata bundled within the compiled binaries during the build process, which allows an attacker to gain unauthorized...

PT-2024-14787 · Synology · Synology Active Backup For Business Agent

Name of the Vulnerable Software and Affected Versions: Synology Active Backup for Business Agent versions prior to 2.7.0-3221 Description: The issue involves missing authentication for a critical function in the proxy settings functionality, allowing local users to obtain user credentials via...

CVE-2024-6785

CVE-2024-6785 affects MOXA MXview One Series (versions before 1.4.1) and MXview One Central Manager Series (before 1.0.3). The issue is cleartext storage of credentials in the configuration file, exploitable by an attacker with local access who can read/modify the file, potentially abusing the se...

CVE-2024-8986 Information Leakage in grafana-plugin-sdk-go

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running git remote get-url origin. If credentials are included in the repository URI for instance, to allow for fetching of private...

VulnCheck KEV: CVE-2018-1000600

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

Lenovo XClarity Controller 安全漏洞

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller that stems from the fact that IPMI credentials may be...

Payara Server 安全漏洞

Payara Server is a cloud-native, innovative, open source middleware platform from Payara UK. A security vulnerability exists in Payara Server that stems from allowing sensitive credentials to be published in plain text in server logs. The following versions are affected: version 6.0.0 through to...

PT-2024-7785 · Palo Alto Networks +1 · Cortex Xsiam +2

Name of the Vulnerable Software and Affected Versions: Cortex XSOAR and Cortex XSIAM affected versions not specified Description: The issue is related to the storage of protected information in an unencrypted form in the ActiveMQ message broker integration. This could allow a remote attacker to...

CVE-2024-39278

Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data...

wget: Misinterpretation of input may lead to improper behavior

A flaw was found in wget. Incorrect handling of semicolons in the userinfo subcomponent of a URI allows it to be misinterpreted as part of the host subcomponent, potentially exposing user credentials...