EulerOS Virtualization 3.0.6.0 : python-urllib3 (EulerOS-SA-2024-1703)

According to the versions of the python-urllib3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redire...

PT-2024-3750 · Unknown · Opupi0 Amqp/Mqtt

Name of the Vulnerable Software and Affected Versions: OPUPI0 AMQP/MQTT versions prior to V5.30 Description: A vulnerability has been identified that allows an attacker with remote shell access or physical access to retrieve credentials due to insufficient protection of stored MQTT client...

CVE-2024-32049

BIG-IP Next Central Manager CM may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-20378

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management...

PT-2024-30249 · E Webinformationco · Fs-Ezviewer

Name of the Vulnerable Software and Affected Versions: E-WEBInformationCo. FS-EZViewerWeb affected versions not specified Description: A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows the attacker to obtain...

CVE-2024-1102 Jberet: jberet-core logging database credentials

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection...

PT-2024-7263 · 1с · Bitrix24 +1

Name of the Vulnerable Software and Affected Versions: 1C-Bitrix Bitrix24 version 23.300.100 Description: The issue concerns insufficiently protected credentials in SMTP server settings, allowing remote administrators to send SMTP account passwords to an arbitrary server via an HTTP POST request...

PT-2024-7256 · 1с · Bitrix24 +1

Name of the Vulnerable Software and Affected Versions: 1C-Bitrix Bitrix24 version 23.300.100 Description: The issue is related to insufficiently protected credentials in AD/LDAP server settings, allowing remote administrators to send AD/LDAP administrators' account passwords to an arbitrary serve...

CVE-2024-3706

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

PT-2024-22374 · Puwell Cloud Tech Co · 360Eyes Pro

Name of the Vulnerable Software and Affected Versions: Puwell Cloud Tech Co, Ltd 360Eyes Pro version 3.9.5.16 Description: The issue allows attackers to intercept and access sensitive information because it transmits this data in cleartext. This includes users' credentials and password change...

The vulnerability of the data integration tool Softing edgeAggregator and the software modules for connecting controllers such as Softing edgeConnector Modbus, Softing edgeConnector 840D, Softing edgeConnector Fanuc CNC, and Softing edgeConnector Siemens lies in the transmission of accounting data in an unencrypted form. This allows unauthorized individuals to gain unauthorized access to protected information.

The vulnerability of the data integration tool Softing edgeAggregator and the software modules for connecting controllers such as Softing edgeConnector Modbus, Softing edgeConnector 840D, Softing edgeConnector Fanuc CNC, and Softing edgeConnector Siemens lies in the transmission of credentials in...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2024-15365)

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server version 11.7 th...

PT-2024-12168 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosu...

PT-2024-18467 · Quarkus · Quarkus

Name of the Vulnerable Software and Affected Versions: Quarkus affected versions not specified Description: A vulnerability was found in Quarkus where, under certain conditions related to the Continuous Integration CI process, git credentials could be inadvertently published. This could put the g...

EulerOS 2.0 SP8 : python-urllib3 (EulerOS-SA-2024-1296)

According to the versions of the python-urllib3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs...

PT-2024-19070 · Gallagher · Gallagher Command Centre

Name of the Vulnerable Software and Affected Versions: Gallagher Command Centre versions 8.60 and prior Gallagher Command Centre versions 8.70 prior to vEL8.70.2526 MR6 Gallagher Command Centre versions 8.80 prior to vEL8.80.1526 MR4 Gallagher Command Centre versions 8.90 prior to vEL8.90.1751 MR...

AnythingLLM Information Disclosure Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an information disclosure vulnerability that stems from allowing the default/manager user to obtain all system database information such as username, password, apikey, etc...

PT-2024-15574 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: The issue allows users with proper authorization levels manager, admin, and when in single user mode to access sensitive information by using a web scraper to query a specific URL:...

jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin

A flaw was found in the Config File Provider Jenkins Plugin. Affected versions of this plugin do not mask replace with asterisks credentials specified in configuration files when they're written to the build log...

IBM Storage Defender 信任管理问题漏洞

IBM Storage Defender is a software suite that enables data resiliency and is part of the IBM Storage portfolio of products and services. An information disclosure vulnerability exists in IBM Storage Defender-Resiliency Service, which can be exploited by a local attacker to obtain hard-coded...