Medium: postgresql94, postgresql95

Issue Overview: pgusermappings view discloses passwords to users lacking server privileges: An authorization flaw was found in the way PostgreSQL handled access to the pgusermappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords fro...

ZTE ADSL ZXV10 W300 Information Disclosure Vulnerability (CNVD-2017-28178)

The ZTE ADSL ZXV10 W300 is an ADSL modem Modem product from China's ZTE Corporation ZTE. A security vulnerability exists in the ZTE ADSL ZXV10 W300 W300V2.1.0fER7PEO57 version and W300V2.1.0hER7PEO57 version. A remote attacker can exploit the vulnerability to obtain user passwords...

BSA-2017-395

Security Advisory ID : BSA-2017-395 Component : PostgreSQL Revision : 1.0: Interim An authorization flaw was found in the way PostgreSQL handled access to the pgusermappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the use...

SMA Solar Technology inverter information disclosure vulnerability

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A security vulnerability exists in the SMA Solar Technology inverter. An attacker could exploit this vulnerability to obtain a user password...

CVE-2017-7737

An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...

SMA Solar Technology inverter weak password vulnerability (CNVD-2017-27847)

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A security vulnerability exists in the SMA Solar Technology inverter, which arises from the program's use of a simple encryption algorithm to encrypt passwords, which can be exploited by an attacker to obtain...

UBUNTU-CVE-2017-7547

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so...

postgresql: pg_user_mappings view discloses foreign server passwords

It was found that the pgusermappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password use...

CVE-2017-11686

Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network, because the password is represented in a cookie with a reversible encoding method...

SQL Injection Vulnerability in ZZCMS Version 8.1

ZZCMS is an enterprise website builder. A SQL injection vulnerability exists in the frontend of ZZCMS version 8.1, which can be exploited by attackers to obtain administrator accounts and passwords...

4: ovirt-engine exposes cloud-init root password via REST API

It is reported that the RHV 4 REST API exposes data used in cloud-init which can include the root password used when creating a system...

CVE-2017-3221

Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords...

DEBIAN-CVE-2017-1000024

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission...

Apache Hadoop Password Exposure Vulnerability (Jan 2017)

Apache Hadoop is prone to a password exposure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop";...

Arbitrary file deletion

Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file...

CVE-2017-9615

Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file...

CVE-2017-9615

Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file...

CVE-2017-9615

CVE-2017-9615 (Cognito Moneyworks) affects Moneyworks 8.0.3 and earlier. The root cause is verbose logging that writes the administrator password to a world-readable file, leading to password exposure and potential administrative access to all data. The description in multiple sources confirms us...

CVE-2017-3745

In Lenovo XClarity Administrator LXCA before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts wi...

CVE-2017-3745

Lenovo XClarity Administrator (LXCA) before 1.3.0 exposes password information for users who previously authenticated to LXCA’s internal LDAP when service data is downloaded. A non-administrative user could access credentials for accounts including administrative/service accounts with privileges,...