Directus allows redacted data extraction on the API through "alias"

Summary A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the alias functionality on the API. Normally, these redacted fields will return however if we change the request to ?aliasworkaround=redacted we can instead retrieve the...

CVE-2024-25581

When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IXFR over DNS over HTTPS, causing the process to stop...

The vulnerability of Unitronics Vision’s microprogrammed logic controllers, related to the storage of passwords in a recoverable format, allows a hacker to obtain the “Information Mode” password in plain text.

The vulnerability of the microprogrammed logic controllers from Unitronics Vision relates to the storage of passwords in a recoverable format. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain the “Information Mode” password in plain text...

CVE-2024-4425

The CemiPark software (versions 4.5, 4.7, 5.03 , and potentially others) contains a vulnerability where access control mechanisms store integration credentials (such as FTP or SIP ) in plain-text . An attacker who gains unauthorized access to the device can retrieve these clear-text passwords. To...

PT-2024-31076 · Cemipark · Cemipark

Name of the Vulnerable Software and Affected Versions: CemiPark software versions 4.5 through 5.03 Description: The access control in CemiPark software stores integration credentials, such as FTP or SIP, in plain-text. An attacker who gains unauthorized access to the device can retrieve clear tex...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

CVE-2024-28971

Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file. A remote high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the...

PT-2024-22654 · Dell · Dell Update Manager Plugin

Name of the Vulnerable Software and Affected Versions: Dell Update Manager Plugin versions 1.4.0 through 1.5.0 Description: The issue concerns a Plain-text Password Storage Vulnerability in the log file of the Dell Update Manager Plugin. A remote high privileged attacker could potentially exploit...

CVE-2023-40510 LG Simple Editor getServerSetting Authentication Bypass Vulnerability

LG Simple Editor getServerSetting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

Jenkins Plugin Telegram Bot 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2024-3625

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

CVE-2024-3623

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...

CVE-2024-3624 Mirror-registry: database user and password stored in plain-text

A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database...

CVE-2024-3625 Mirror-registry: redis password stored in plain-text

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

CVE-2024-3624

CVE-2024-3624 concerns Quay’s mirror-registry where database credentials are stored in plain-text in the Jinja config.yaml. The issue, documented in multiple sources, states that a malicious actor with access to that file can gain access to Quay’s database. The connected PT-2024-3593 advisory con...

CVE-2024-3625 Mirror-registry: redis password stored in plain-text

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

CVE-2024-3623 Mirror-registry: default database secret key stored in plain-text on initial configuration file

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...

CVE-2024-3623

CVE-2024-3623 describes a flaw in using mirror-registry to install Quay where a default database secret key is stored in plain text within a configuration template. This can cause all Quay instances deployed via mirror-registry to share the same database secret key, enabling a malicious actor to ...