Play Framework Inadequate Encryption Strength vulnerability

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

GHSA-35C4-5QFP-WXJ6 Mattermost Server exposes team creator's e-mail address to other members

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members...

Openstack cinder Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

GHSA-JMP9-F42Q-4G85 Passwords stored in plain text by Harvest SCM Plugin

Harvest SCM Plugin 0.5.1 and earlier stores SCM passwords unencrypted in its global configuration file hudson.plugins.harvest.HarvestSCM.xml and in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission job config.xml only or access ...

Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

GHSA-56GJ-927P-MFPH Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...

Wikimedia MediaWik exposed suppressed log in RevisionDelete page

Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Trellix: Sensitive Information Disclosure

Sensitive information, including Personally Identifiable Information PII data, was being disclosed through JEB 4.2.0.202106271614 licensed to a specific user. The vulnerability allowed unauthorized access to the information and could potentially lead to data breaches...

Design/Logic Flaw

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the idrsa.pub public key of the keypair was copied to authorizedkeys files on remote host, those hosts...

CVE-2022-29165

creationtimestamp| type| source ---|---|--- 2022-05-20 18:31:32+00:00| seen| https://t.me/cibsecurity/43061 2024-04-04 16:48:44+00:00| published-proof-of-concept| https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/argocdexposedui...

PT-2022-16975 · Nextcloud · Nextcloud Deck

Name of the Vulnerable Software and Affected Versions: Nextcloud Deck versions prior to 1.2.11 Nextcloud Deck versions prior to 1.4.6 Nextcloud Deck versions prior to 1.5.4 Description: Nextcloud Deck is a Kanban-style project and personal management tool for Nextcloud, similar to Trello. The ful...

VMware Spring Cloud Gateway Code Injection Vulnerability

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured...

Cobbler has Exposed Dangerous Method or Function

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

GHSA-HXCW-PQQC-RV85 Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

PT-2022-3410

Name of the Vulnerable Software and Affected Versions eventsource/eventsource versions prior to 2.0.2 Description The issue is related to insufficient protection of sensitive data, allowing a remote attacker to gain unauthorized access to protected information. This is due to the improper removal...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

Secomea GateManager Information Disclosure Vulnerability

Secomea GateManager is a remote access server product from the Danish company Secomea. security vulnerability exists in all versions of Secomea GateManager prior to 9.7. The vulnerability stems from the exposure of query string information in GET requests of the LMM API, which could be exploited ...

Design/Logic Flaw

On all versions 1.3.x fixed in 1.4.0 NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2022-25990

On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...