GHSA-3HWC-RQWP-V36Q Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

HID iCLASS SE reader Authorization Issues Vulnerability

The HID Global HID iCLASS SE reader is an authentication reader from HID Global, USA. An authorization issue vulnerability exists in the HID iCLASS SE reader that stems from the inclusion of credentials and a device administrator key in the reader's configuration card...

CVE-2024-22433

Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.getldapinfo in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity,...

PT-2024-19381 · Hid Global · Omnikey 5023 Readers +15

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns certain configurations in the communication channel for encoders that could expose sensitive data when reader configuration cards are...

OpenConnect Security Vulnerability

OpenConnect is an open source application for connecting to virtual private networks. A security vulnerability exists in OpenConnect 7.08 and earlier versions, which stems from credentials and session cookie information being stored insecurely in memory, which can be scanned and credentials...

PT-2024-18197 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: A critical issue in the calendar feature of Microsoft Outlook exposes Windows login credentials to remote theft. To protect against this, enabling multi-factor authentication is...

CVE-2024-1102

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat...

CVE-2023-29055 Apache Kylin: Insufficiently protected credentials in config file

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP or other plain text protocol, it is possible for network sniffers to hijack the HTTP...

PT-2024-1434 · Unknown · Machinesense +3

Name of the Vulnerable Software and Affected Versions: MachineSense affected versions not specified FeverWarn ESP32 affected versions not specified FeverWarn RaspberryPi affected versions not specified FeverWarn DataHub RaspberryPi affected versions not specified Description: The cloud provider...

CVE-2024-0556

A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text...

Xantech WIC1200 Security Vulnerability

The Xantech WIC1200 is a Web Intelligence Controller from Xantech. A security vulnerability exists in the Xantech WIC1200 version 1.1 that originates from a vulnerability that allows a remote user to intercept traffic and retrieve other users' credentials and decode them in Base64, which can be...

PYSEC-2024-2

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

Appwrite Security Vulnerabilities

Appwrite is Appwrite open source an end-to-end backend server . It is used to package web, mobile, native or backend applications as a set of Docker microservices. A security vulnerability exists in the Appwrite CLI prior to version 3.0.0, which stems from the fact that when the login command is...

CVE-2023-5384

CVE-2023-5384 affects Infinispan: when serializing a cache configuration to XML/JSON/YAML that contains credentials (e.g., JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration. This exposes sensitive data if the configuration i...

PT-2023-8930 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 8.11.2 Description: An issue was discovered whereby sensitive information may be recorded in Kibana logs in the event of an error or when debug level logging is enabled. The messages recorded in the log may contain...

IBM API Connect Security Vulnerability

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from International Business Machines IBM. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in IBM API Connect versions V10.0.5....

infinispan: Credentials returned from configuration as clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...

LOYTEC electronics GmbH LINX Configurator Security Breach

LOYTEC electronics GmbH LINX Configurator is a tool from the Austrian company LOYTEC electronics GmbH for configuring and managing devices on its LINX platform. A security vulnerability in LOYTEC electronics GmbH LINX Configurator version 7.4.10, which stems from the use of base64-encoded clearte...

CVE-2023-48700

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...

Code injection

The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are...