openSUSE Security Update : Chromium (openSUSE-2019-548)

This update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed bsc1095163 : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia -...

PT-2019-16637

Name of the Vulnerable Software and Affected Versions McAfee Database Security versions prior to 4.6.6 Description The issue allows local users to expose passwords via incorrectly auto-completing password fields in the admin browser login screen. This occurs due to a Data Leakage Attacks...

curl: NTLM buffer overflow via integer overflow

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

Google Chrome Views Unauthorized Access Vulnerability

Google Chrome is a web browser developed by Google, Inc.Views is one of the view components. A security vulnerability exists in Views in versions of Google Chrome prior to 67.0.3396.62, which stems from a failure to use operating system protection for password fields. An attacker could exploit th...

DEBIAN-CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

ALPINE-CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

Taking HTTPS Denial to an Absurd Level

Sometimes fighting good security is harder than embracing it. That appears to be the case with at least one company that went to great lengths to avoid insecure HTTPS browser security warnings from appearing on the thousands of sites it managed. The company in question is ShopCity.com, a...

Legal Robot: Autocomplete feature

A security researcher discovered that several password fields did not contain the Autocomplete attribute. Thanks to @gujjuboy10x00 for pointing this out!...

Design/Logic Flaw

The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...

CVE-2016-7060

The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...

PT-2017-9082

Name of the Vulnerable Software and Affected Versions Red Hat QuickStart Cloud Installer QCI version 1.0 Description The issue concerns the web interface of the affected software, where password fields are not masked. This allows physically proximate attackers to obtain sensitive password...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2017:0690-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QCI: qci exposes password in web UI when they should be masked

It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services...

CVE-2016-7060

It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services...

CVE-2016-1601

yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors...

SUSE-SU-2016:1138-1 Security update for yast2-users

yast2-users was updated to fix one security issue. This security issue was fixed: - CVE-2016-1601: Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation bsc974220. This update includes a script that fixes installations that we're affected by this problem. It is run...

PT-2016-4883

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 3.1.47 Description The issue is related to the improper setting of empty password fields in /etc/shadow during an AutoYaST installation. This occurs when the profile does not contain inst-sys users, which might...

CVE-2009-4872

Multiple SQL injection vulnerabilities in globepersonnellogin.asp in Logoshows BBS 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password fields...

CVE-2008-0286: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/login.php in Article Dashboard allows remote attackers to execute arbitrary SQL commands via the 1 user or 2 password fields...