UBUNTU-CVE-2020-10755

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

CVE-2020-10755

OpenStack Cinder CVE-2020-10755 affects multiple OpenStack Cinder releases prior to specific upgrades (14.1.0 for 14.x, 15.2.0 for 15.x, 16.1.0 for 16.x) when using Dell EMC ScaleIO or VxFlex OS backends. The vulnerability exposes backend credentials in the connection_info of Block Storage v3 Att...

PT-2020-13380 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.3.6 HashiCorp Vault and Vault Enterprise versions prior to 1.4.2 Description: The issue concerns the logging of proxy environment variables that may contain sensitive credentials. This...

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin allows a hacker to obtain user credentials.

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials...

Unspecified Vulnerability in Foxit Reader and PhantomPDF (CNVD-2020-32463)

Foxit Reader and Foxit PhantomPDF are both Chinese Foxit Foxit company a PDF document reader. A security vulnerability exists in Foxit Reader prior to version 9.2 and PhantomPDF prior to version 9.2. The vulnerability can be exploited to obtain NTLM credentials through GoToE or GoToR operations...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

Medium: python-virtualenv

Issue Overview: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in...

Unspecified Vulnerability in NETGEAR RAX40

The NETGEAR RAX40 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR RAX40 prior to version 1.0.3.64, which can be exploited by an attacker to obtain administrative credentials...

CVE-2020-11694

In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3...

CVE-2020-5406

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with...

Palo Alto Networks VM Series firewalls trust management issue vulnerability

Palo Alto Networks VM Series firewalls is a virtualized firewall product from Palo Alto Networks, USA. A trust management issue vulnerability exists in Palo Alto Networks VM Series firewalls that stems from the inclusion of account credentials in technical support files. An attacker could exploit...

CVE-2020-1978

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability HA inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in...

CVE-2018-18074

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

PT-2020-4209 · D Link · D-Link Dsl-2875Al +1

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 Description: The issue is related to information disclosure via a crafted request to "index.asp" on the web management server. This is due to the username v and password v variables. Th...

PT-2020-10138 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: OpenShift versions 4.2 Description: The issue arises during the installation of an OpenShift 4 cluster, where the openshift-install command line tool creates an auth directory. This directory contains kubeconfig and kubeadmin-password files,...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

Unauthorized Access Vulnerability in Kodak Video Surveillance Devices

hereinafter referred to as KODAK is a provider of video and security products and solutions, dedicated to video conferencing, video surveillance and a wealth of video application solutions to help all kinds of government and enterprise customers to solve the visual communication and management...

CVE-2019-5648

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware = v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be us...