ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs...

Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw...

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs...

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p "; this operation does not fail if...

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs...

githubFind3r - Fast Command Line Repo/User/Commit Search Tool

githubFind3r is a very fast command line repo/user/commit search tool Installation git clone https://github.com/atmoner/githubFind3r.git cd githubFind3r npm install Run it node githubFind3r.js Download githubFind3r...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

August 11, 2015, update for Office 2010 (KB3054962)

August 11, 2015, update for Office 2010 KB3054962 This article describes update KB3054962 for Microsoft Office 2010 that was released on August 11, 2015. This update has a prerequisite. Improvements and fixes Fixes the following issue:When you open a file .xlsx, .pptx, or .docx and then save it a...

Scientific Linux Security Update : libosinfo on SL7.x x86_64 (20200407)

Libosinfo: osinfo-install-script option leaks password via command line argument C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135815; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

LY Corporation: Improper Access Control in LINE Timeline API that returns a list of hidden friends

Due to an insufficient access control check in an API endpoint for LINE Timeline function, it was possible for an attacker to retrieve a hidden list of any LINE users. Users can configure the hidden list not to show someone's post on their Timeline. Using this vulnerability, an attacker can get a...

Receiver 4.4 Selfservice.exe -terminate Does Not Disconnect Sessions

Citrix receiver 4.4. Selfservice.exe -terminate. When running this command line there is no response of the command other commands appear to work as expected. CTX200337 -Driving the Citrix Receiver Self-Service Plug-in Programmatically...

CVE-2019-10610

Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

Buffer overflow

Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

The vulnerability in the ImageStream::getLine method from the poppler/Stream.cc library used for displaying PDF files allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the ImageStream::getLine method in the Poppler/Stream.cc library for displaying PDF files is related to the output of operations that go beyond the acceptable buffer data limits. Exploiting this vulnerability could allow an attacker to gain access to confidential data,...

The vulnerability of the operating system utility package OC SUSE Linux Supportutils lies in the lack of measures to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability of the operating system utility package for SUSE Linux Supportutils lies in the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an attacker to execute arbitrary commands by controlling the rp...

Unspecified vulnerability in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 (CNVD-2021-17243)

MB CONNECT LINE mbCONNECT24 and MB CONNECT LINE mymbCONNECT24 are both products of MB CONNECT LINE, Germany.MB CONNECT LINE mbCONNECT24 is a set of remote service portals. The product supports remote access, data logging and alarms.MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 have an unspecified vulnerability security vulnerability

MB CONNECT LINE mbCONNECT24 and MB CONNECT LINE mymbCONNECT24 are both products of MB CONNECT LINE, Germany.MB CONNECT LINE mbCONNECT24 is a set of remote service portals. The product supports remote access, data logging and alarms.MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 Privilege Management Error Vulnerability

Mb Connect Line MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE Mb Connect Line, Germany. A privilege management error vulnerability exists in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24, which can be exploited by an attacke...

CVE-2020-10384

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the root account...

CVE-2020-10384

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the root account...