CVE-2020-4477

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779...

CVE-2020-4477

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779...

CVE-2020-4477: Insertion of Sensitive Information into Log File

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779...

Security Bulletin: Information Disclosure via IBM Spectrum Protect Plus virgo log file (CVE-2020-4477)

Summary IBM Spectrum Protect Plus virgo log file may disclose sensitive information in plain text. Vulnerability Details CVEID: CVE-2020-4477 DESCRIPTION: IBM Spectrum Protect Plus discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks...

F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...

CVE-2020-12023 Philips IntelliBridge Enterprise IBE Insertion of Sensitive Information into Log File

Philips IntelliBridge Enterprise IBE, Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns VS4, EarlyVue VS30 and IntelliVue Guardian IGS. Unencrypted user credentials received in the IntelliBridge Enterprise IBE are logged within the transaction logs, which are...

Information disclosure

An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'...

PT-2020-2937

Name of the Vulnerable Software and Affected Versions Visual Studio Code Live Share Extension affected versions not specified Description An information disclosure issue exists in Visual Studio Code Live Share Extension, where it exposes tokens in plain text. This could allow a remote attacker to...

WhatsApp Phone Numbers Pop Up in Google Search Results — But is it a Bug?

UPDATE A researcher is warning that a WhatsApp feature called “Click to Chat” puts users’ mobile phone numbers at risk — by allowing Google Search to index them for anyone to find. But WhatsApp owner Facebook says it is no big deal and that the search results only reveal what the users have chose...

PT-2020-3697

Name of the Vulnerable Software and Affected Versions NPort IAW5000A-I/O Series affected versions not specified Description The issue is related to the implementation of the Basic HTTP Authentication method in the NPort IAW5000A-I/O Series web server software, which involves the transmission of...

[SECURITY] Fedora 31 Update: python-markdown2-2.3.9-1.fc31

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

curl: Partial password leak over DNS on HTTP redirect

Summary: From version 7.62 curl and curllib leaks part of user credentials in the plain text DNS request. This happens if the server makes redirect, both 301 and 302 to a relative path eg header 'Location: /login'. It is NOT an issue in case of absolute redirection eg header 'Location:...

CVE-2019-13021

Bond JetSelect (all versions) stores administrator passwords in an unprotected filesystem file ( /opt/JetSelect/SFC/resources/sfc-general-properties ), instead of encrypting them in the database. The passwords are created via ENCtool.jar during installation and backed up by the installer, enablin...

Node.js third-party modules: [plain-object-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in plain-object-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: plain-object-merge version: 1.0.1 npm page: https://www.npmjs.com/package/plain-object-merge Module Description Extremely fa...

Security Bulletin: A security vulnerability in IBM Websphere affects IBM Tivoli Netcool Performance Manager for Wireline (CVE-2013-0169)

Summary The Lucky Thirteen attack is a cryptographic timing attack against implementations of the Transport Layer Security TLS protocol that use the CBC mode of operation. An attacker could perform main in the middle attacks to successfully obtain plain text from the secure channel. Vulnerability...

CVE-2019-4668

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

CVE-2019-4668

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

Code injection

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

CVE-2019-4668

IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...

CVE-2019-4668

CVE-2019-4668 affects IBM UrbanCode Deploy (UCD). The connected IBM security bulletin and NVD entry confirm that UCD stores user credentials in plaintext, readable by a local user, due to improper credential storage. Impact is confidentiality loss for credentials; exploitability is local. Remedia...