OPENSUSE-SU-2019:1089-1 Security update for yast2-rmt

This update for yast2-rmt to 1.2.2 fixes the following issues: Security issue fixed: - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed: - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672 This...

CVE-2018-1838

IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of passwords. IBM X-Force ID: 150811...

IBM WebSphere Application Server Information Disclosure Vulnerability (CNVD-2018-24363)

IBM Cloud is a set of open-standard cloud platforms from IBM in the U.S. WebSphere Application Server is one of the application server products, which is a platform for Java EE and Web service applications, and the foundation of the IBM WebSphere software platform. A security vulnerability exists...

Design/Logic Flaw

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password...

IBM WebSphere MQ 7.0.0.x / 8.0.0.x Password Handling Remote Access Vulnerability

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is 7.0.0.x or 8.0.0.x without patch APAR PM52049 C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108485; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/08";...

IBM WebSphere Application Server Virtual Member Manager Elevation of Privilege Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications and the foundation of the IBM WebSphere software platform.Virtual Member Manager is one of the virtual environment manageme...

UBUNTU-CVE-2018-1000035

A heap-based buffer overflow exists in Info-Zip UnZip version = 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution...

CVE-2017-7898

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions;...

Apple Mac OS X Multiple Vulnerabilities-03 (Feb 2017)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system arises from the improper handling of NTLM password change requests. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially created application...

KarjaSoft Sami FTP Server Remote Buffer Overflow Vulnerability

Sami FTP Server is an FTP service program. Sami FTP Server version 2.0.2 suffers from an overflow vulnerability in the handling of usernames and passwords supplied by users connecting to the server, which allows users to send overly long parameters to the buffer via a number of commands, which ca...

SUSE SLES12 Security Update : libstorage (SUSE-SU-2016:2355-1)

This update for libstorage fixes the following issues : - Use stdin, not tmp files for passwords bsc986971, CVE-2016-5746 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and...

SUSE-SU-2016:2355-1 Security update for libstorage

This update for libstorage fixes the following issues: - Use stdin, not tmp files for passwords bsc986971, CVE-2016-5746...

SUSE SLED12 / SLES12 Security Update : libstorage (SUSE-SU-2016:2189-1)

This update for libstorage fixes the following issues : - Use stdin, not tmp files for passwords bsc986971, CVE-2016-5746 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and...

SUSE-SU-2016:2189-1 Security update for libstorage

This update for libstorage fixes the following issues: - Use stdin, not tmp files for passwords bsc986971, CVE-2016-5746...

CVE-2016-0733

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username...

Vulnerabilities in the Grub2 operating system loaders, which allow attackers to obtain confidential information or cause service failures

The multiple vulnerabilities of the Grub2 operating system’s loader are caused by a loss of precision for an integer. Exploiting these vulnerabilities allows a local attacker to bypass authentication procedures, obtain confidential information, or cause a service failure disk corruption by using...

SUSE-SU-2015:2387-1 Security update for grub2

Fix buffer overflows when reading username and password. bsc956631, CVE-2015-8370 - Check MS-DOS header to find PE file header. bsc954126 - Use dirname for copying Xen kernel and initrd to esp. bsc955493 - Fix reading password by grub2-mkpasswd-pbdk2 without controlling tty. bsc954519 - Add luks,...

Cisco Unified MeetingPlace Web Page Source Code Remote Password Disclosure (CSCuu33050)

According to its self-reported version number, the Cisco Unified MeetingPlace application hosted on the remote web server is potentially affected by an information disclosure vulnerability due to improper handling of passwords. An authenticated, remote attacker can obtain plaintext passwords by...

GLSA-201507-09 : PyPAM: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201507-09 PyPAM: Arbitrary code execution PyPAM does not handle passwords correctly if there is NULL byte in the string. Impact : A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition...