DEBIAN-CVE-2020-15646

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This...

CVE-2020-15646

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This...

Design/Logic Flaw

Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access to them. This is resolved in Continuous Delivery for Puppet Enterprise 4.0.1...

CloudBees Jenkins Skytap Cloud CI Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Skytap Cloud CI Plugin is used in one of the plug-in for...

Unspecified Vulnerability in CloudBees Jenkins Backlog Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software release/testing projects and some timed tasks . Backlog Plugin is used in one of the project...

CVE-2020-4546

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314...

IBM Security Guardium Data Encryption (GDE) Plaintext Storage Vulnerability (CNVD-2020-49941)

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. A plaintext storage vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which can be...

CVE-2020-4593

IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747...

PT-2020-15456 · Jenkins · Jenkins Pipeline Maven Integration Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline Maven Integration Plugin versions 3.8.2 and earlier Description: A cross-site request forgery CSRF vulnerability exists, allowing attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs...

react-native-fast-image information disclosure vulnerability

react-native-fast-image is an image loading and processing package by Canadian software developer Dylan Vann. An information disclosure vulnerability exists in react-native-fast-image, which can be exploited by an attacker to cause signature credentials or other session tokens to be disclosed to...

CVE-2020-7517

A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder Version 1.4.7.2 and older which could allow an attacker to read user credentials...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-14499

Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials...

UBUNTU-CVE-2020-15095

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://:@::/". The password value is not redacted and is printed to stdout and also to any generated log files...

USN-4402-1 curl vulnerabilities

Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered that curl incorrectly handled certain credentials. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. CVE-2020-8169 It was discovered that curl incorrectl...

PT-2020-13402 · Amazon +1 · Amazon Eks +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 through 13.0.1 Description: The issue allows other administrators to view Amazon EKS credentials via HTML source code, potentially leading to unauthorized access. Recommendations: For GitLab CE/EE versions 12.6...

PT-2020-12312 · Jaegertracing · Jaeger

Name of the Vulnerable Software and Affected Versions: jaegertracing/jaeger versions prior to 1.18.1 Description: A sensitive information exposure issue was discovered when the Kafka data store is used, allowing an attacker with access to the container's log file to obtain the Kafka credentials...

CVE-2020-13650

An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery SSRF that allows use of the application as a proxy. Sent to an external server, a forged request discloses application credentials. For a request to ...

DEBIAN-CVE-2020-10755

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

PYSEC-2020-228

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...