convert2rhel: Activation key passed via command line by code

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line v...

CVE-2022-0851

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line v...

CVE-2022-0851

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line v...

CVE-2022-0851

CVE-2022-0851 concerns convert2rhel exposing the activation key in process command lines when passing it to subscription-manager. Public docs tie this to the Convert2RHEL utility and indicate an exposure that could enable fraud via registering systems using the victim’s activation key. Red Hat ad...

PT-2022-13472 · Unknown · Convert2Rhel

Name of the Vulnerable Software and Affected Versions: convert2rhel affected versions not specified Description: The issue is related to the use of the --activationkey option with convert2rhel, which passes the activation key to subscription-manager via the command line. This could allow...

CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

CVE-2022-34575

An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml...

CVE-2022-36321

In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases...

CVE-2021-40149

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI...

CVE-2021-40149

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI...

MAL-2022-1485 Malicious code in bcztpuiojndlhmvx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b561e6c70dc5155abc61d9b26a2a49a210a7bf5a0d229078a181dfa46a22a56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34804: Cleartext Transmission of Sensitive Information

Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure...

CVE-2022-34060

The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

MAL-2022-1525 Malicious code in bfx-facs-grc-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cfcf4ec66cbefa85f2c259a3d914576dc423f2569c6a432be4ad3c4e41ae949 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1636 Malicious code in body-complex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef48c53ad39055a3692dbe528815988861df665507cc31c52dad47e5f746b3e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Double Public Key Signing Function Oracle Attack on `ed25519-dalek`

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs. Such APIs and serializations are inherently unsafe as the public key is one of th...

PT-2022-11738 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue allows an attacker to obtain sensitive information, such as wifikey, without authorization through the getSysStatusCfg function. Recommendations: For TOTOLINK EX1200T version...

FlightRadar24 安全漏洞

FlightRadar24 is a global flight tracking service from the US company FlightRadar24. Real-time information is available for thousands of airplanes around the world. A security vulnerability exists in FlightRadar24 for Android versions v8.9.0, v8.10.0, v8.10.2, v8.10.3, and v8.10.4, which can be...

GHSA-6WCR-WCQM-3MFH Django settings leak in date template filter

The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...