3953 matches found
Some D-Link and Comba WiFi Routers Leak Their Passwords in Plaintext
What could be worse than your router leaking its administrative login credentials in plaintext? Cybersecurity researchers from Trustwave's SpiderLabs have discovered multiple security vulnerabilities in some router models from two popular manufacturers—D-Link and Comba Telecom—that involve insecu...
CVE-2019-11064
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...
Authentication flaw
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...
CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...
CVE-2019-11064: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any...
CVE-2019-10391
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...
Code injection
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...
CVE-2019-10391
Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure...
CVE-2019-10391
The CVE-2019-10391 entry concerns the Jenkins IBM Application Security on Cloud Plugin (versions 1.2.4 and earlier). The root cause is that configured passwords were transmitted in plain text as part of job configuration forms, creating a potential exposure of sensitive credentials. Public disclo...
ibm-application-security showed plain text password in job configuration form fields
ibm-application-security stores service passwords in job configurations. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...
PT-2019-11785 · Ibm +1 · Jenkins Ibm Application Security On Cloud Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins IBM Application Security on Cloud Plugin versions 1.2.4 and earlier Description: The issue is related to the transmission of configured passwords in plain text as part of job configuration forms, potentially resulting in their exposur...
CVE-2019-3753
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the...
CVE-2019-3753
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the...
CVE-2019-3753
Dell EMC PowerConnect devices (8024, 7000, M6348, M6220, M8024 and M8024-K) with firmware versions prior to 5.1.15.2 store TACACS/RADIUS credentials in plain text in the system settings menu. An authenticated user with access to system settings can obtain the exposed credentials and use them for ...
RHEL 7 : Red Hat Virtualization (RHSA-2019:2437)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2437 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...
RHEL 7 : cockpit-ovirt (RHSA-2019:2433)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2433 advisory. Cockpit is a Linux system adminstration tool with a web UI, easy setup, and minimal system footprint at runtime. When installed on hosts in Red Hat...
Moderate: Red Hat Security Advisory: cockpit-ovirt security, bug fix, and enhancement update
An update for cockpit-ovirt is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
A credential-protection flaw was found in cockpit-ovirt. During deployment, it generated an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contained both admin and appliance passwords as plain-text. Although these files are deleted at the end of th...
undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...