EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2022-2087)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated...

CVE-2022-22998: Insufficiently Protected Credentials

Implemented protections on AWS credentials that were not properly protected...

Rocky Linux 8 : curl (RLSA-2022:5313)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5313 advisory. - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections withou...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2022-1991)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections...

Oracle Linux 9 : curl (ELSA-2022-5245)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5245 advisory. - fix too eager reuse of TLS and SSH connections CVE-2022-27782 - fix leak of SRP credentials in redirects CVE-2022-27774 - fix credential leak on...

GHSA-5MXG-P5QH-2GCH Jenkins Deployment Dashboard Plugin has Insufficiently Protected Credentials

Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials...

CVE-2022-23725: Insufficiently Protected Credentials

PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances...

Oracle Linux 8 : curl (ELSA-2022-5313)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5313 advisory. - fix too eager reuse of TLS and SSH connections CVE-2022-27782 - fix credential leak on redirect CVE-2022-27774 - fix auth/cookie leak on redirect...

PT-2022-21933

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation versions 21.0.1 through 21.0.2 Description The issue allows a user with physical access to the system to obtain sensitive information due to insufficiently protected access tokens. Recommendations For versions...

CVE-2022-33953: Insufficiently Protected Credentials

IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected access tokens. IBM X-Force ID: 229198...

Secheron SEPCOS Control and Protection Relay

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Secheron Equipment: SEPCOS Control and Protection Relay Vulnerabilities: Improper Enforcement of Behavioral Workflow, Lack of Administrator Control over Security, Improper Privilege Management,...

Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens (CVE-2022-33953))

Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to insufficiently protected access tokens CVE-2022-33953 Vulnerability Details CVEID:CVE-2022-33953 DESCRIPTION: IBM Robotic Process Automation could allow a user with psychical access to the system to obtain sensitive...

GHSA-HFJR-M75M-WMH7 Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials

Jenkins Zulip Plugin prior to 1.1.1 stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

GHSA-6XW9-QQ9H-CR68 Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials

Jenkins Dynatrace Application Monitoring Plugin prior to 2.1.4 stores credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. NOTE: This plugin is marked as DEPRECATED...

GHSA-8GQ4-X72R-6XCR Jenkins Google Calendar Plugin has Insufficiently Protected Credentials

Google Calendar Plugin stores a calendar password unencrypted in job config.xml files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

GHSA-826H-FXFF-HPQF Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials

Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is...

CVE-2022-30018

Mobotix Control Center (MxCC) up to version 2.5.4.5 is affected by CVE-2022-30018 due to storing passwords in a recoverable format inside MxCC.ini, resulting in insufficient credential protection. This allows an attacker using the machine to obtain admin access to the software and access to recor...

CVE-2022-1413: Insufficiently Protected Credentials

Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface...

CVE-2022-30018: Insufficiently Protected Credentials

Mobotix Control Center MxCC through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file. The credential storage method in this software enables an attacker/user of the machine to gain admin access to the software and gain access...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2022:1657-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1657-1 advisory. - CVE-2022-27776: Fixed auth/cookie leak on redirect bsc1198766 - CVE-2022-27775: Fixed bad loca...