CVE-2020-7233

KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOORNAME variable in the BCLogon.swf file...

CVE-2020-7233

KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOORNAME variable in the BCLogon.swf file...

CVE-2020-7233

CVE-2020-7233 affects KMS Controls BAC-A1616BC BACnet devices, where the BACKDOOR_NAME field in BC_Logon.swf stores the password in cleartext (snowman). Public records from NVD/Red Hat/NVD entries confirm the issue and its explicit description. The vulnerability arises from a plaintext credential...

CVE-2020-7233: Insufficiently Protected Credentials

KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOORNAME variable in the BCLogon.swf file...

PT-2020-19483

Name of the Vulnerable Software and Affected Versions KMS Controls BAC-A1616BC BACnet devices affected versions not specified Description The issue concerns a cleartext password, specifically the value snowman, stored in the BACKDOOR NAME variable within the BC Logon.swf file. This poses a...

Cloudera Navigator Key Trustee KMS Encryption Issue Vulnerability

Cloudera Navigator Key Trustee KMS is a customized secret key management server from Cloudera. A security vulnerability exists in Cloudera Navigator Key Trustee KMS versions 5.12 and 5.13. An attacker can exploit the vulnerability to recover previously deleted but not cleaned keys or delete the...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

Design/Logic Flaw

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

CVE-2018-6185 concerns Cloudera Navigator Key Trustee KMS (versions 5.12 and 5.13). The root cause is an incorrect default ACL configuration for the two additional APIs (PURGE and UNDELETE) that govern encryption-zone keys; the ACLs default to “*”, permitting remote access to these commands. This...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

PT-2019-11009

Name of the Vulnerable Software and Affected Versions: Cloudera Navigator Key Trustee KMS versions 5.12.0 through 5.13.0 Description: The issue arises from incorrect default ACL values in Cloudera Navigator Key Trustee KMS, allowing remote access to purge and undelete API calls on encryption zone...

CVE-2018-6185: Undefined Security Weakness

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

Apache Hadoop KMS ACL Regression Vulnerability

Apache Hadoop is prone to a KMS ACL regression vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"; if...

CVE-2019-4143

The IBM Cloud Private Key Management Service IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain sensitive from the KMS plugin container log. IBM X-Force ID: 158348...

CVE-2019-4143

The CVE-2019-4143 issue affects IBM Cloud Private before patches: IBM Cloud Private Key Management Service (KMS) in versions 3.1.1 and 3.1.2 can allow a local attacker to obtain sensitive information from the KMS plugin container log. Root cause involves information disclosure via container logs ...

PT-2019-16924

Name of the Vulnerable Software and Affected Versions IBM Cloud Private versions 3.1.1 through 3.1.2 Description The issue allows a local user to obtain sensitive information from the KMS plugin container log. Recommendations For IBM Cloud Private versions 3.1.1 and 3.1.2, consider restricting...

CVE-2019-4143: Insertion of Sensitive Information into Log File

The IBM Cloud Private Key Management Service IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain sensitive from the KMS plugin container log. IBM X-Force ID: 158348...

CVE-2018-11767

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms...

CVE-2018-11767

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms...

PT-2019-8794

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions 2.7.5 through 2.7.6 Apache Hadoop versions 2.8.3 through 2.8.4 Apache Hadoop versions 2.9.0 through 2.9.1 Description The issue concerns incorrect user access control in Apache Hadoop, specifically when non-default group...