OPENSUSE-SU-2019:1495-1 Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root

This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues: - CVE-2019-5021: Include an invalidated root password by default, not an empty one bsc1134524 This update was imported from the SUSE:SLE-15:Update update project...

SUSE-SU-2018:3476-1 Security update for MozillaFirefox

This update for MozillaFirefox to 60.2.2ESR fixes the following issues: Security issues fixed: MFSA 2018-24: - CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution bsc1110506 - CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in th...

CVE-2018-12383

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is...

SUSE-SU-2018:1194-1 Security update for python-pysaml2

This update for python-pysaml2 fixes the following issues: - CVE-2017-1000433: When python optimizations are enabled, any user is able to login without knowing their password. bsc1074662...

CVE-2017-12723

A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in the configuration file, which are accessible if the pump is configured to allow external communications...

MISP Information Disclosure Vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the 'adminedit' function of the app/Controller/UsersController.php file in MI...

CVE-2016-0872

A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral WDC versions prior to Version 3.4.0. WDC stores password credentials in plaintext...

CVE-2016-0872

Kabona AB WebDatorCentral (WDC) versions prior to 3.4.0 store password credentials in plaintext due to plaintext storage of a password (CWE-256). CVE-2016-0872 corresponds to this vulnerability, affecting WDC’s authentication data handling. Public documentation from NVD and CNVD/ICS-CERT indicate...

MGASA-2017-0316 Updated postgresql9.3/4/6 packages fix security vulnerabilities

libpq, and by extension any connection driver that utilizes libpq, ignores empty passwords and does not transmit them to the server. When using libpq or a libpq-based connection driver to perform password-based authentication methods, it would appear that setting an empty password would be the...

CVE-2017-7913

CVE-2017-7913 affects Moxa OnCell devices (G3110-HSPA/G3110-HSDPA, G3150-HSDPA, 5104-HSDPA/HSPA, 5004-HSPA). Root cause: the device configuration files store passwords in plaintext, enabling potential credential exposure. Impact stated in sources ranges from partial confidentiality loss to authen...

CVE-2017-7913

A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

SUSE-SU-2016:2353-1 Security update for yast2-storage

This update for yast2-storage provides the following fixes: Security issues fixed: - Use standard IPC, and not temporary files, to pass passwords between processes. bsc986971, CVE-2016-5746 Non security bugs fixed: - Fix usage of complete multipath disk as LVM physical volume. bsc984245 - Load th...

SUSE-SU-2016:2053-1 Security update for libvirt

This update for libvirt fixes one security issue: - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes: - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...

SUSE-SU-2016:1944-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2016-5008: empty VNC password disables authentication bsc987527 Bugs fixed: - bsc970906: Fixed a race condition in xenstore event handling. - bsc952889: Change hap setting to align with Xen behavior. - Fixed 'make...

Unable to Change Expired Passwords in Wyse Thin Client

When a user's password expire and they reach out to Internal IT support department,thepassword is changed for the user and ashot password is given. 2. When the user then enters his new password and instead of being allowed to log on and change his password, they get "Citrix Sign on failed". On...

ABB PCM600 Credential Protection Vulnerability (CNVD-2016-03751)

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. The ABB PCM600 master application password is not properly saved after it has been changed. A local attacker could exploit this vulnerability to access the affected device...

Xceedium Xsuite Arbitrary Access to Root User Vulnerability

Xceedium Xsuite is a unified identity management solution from Xceedium that provides access control, monitoring and logging capabilities for hybrid cloud environments. The solution supports access control policies based on roles or individual users. Xceedium Xsuite has a security vulnerability d...

Low: Red Hat Bug Fix Advisory: conga bug fix update

Updated conga packages that provide critical bug fixes are now available. The Conga package is a web-based administration tool for remote cluster and storage management. This erratum applies the following bug fixes: - The borrowed Zope packages used by Conga have been patched to eliminate a...

CVE-2006-1898

Multiple cross-site scripting XSS vulnerabilities in Ralph Capper Tiny PHP Forum TPF 3.6 allow remote attackers to inject arbitrary web script or HTML via 1 the uname parameter in a view action in profile.php and 2 a login name. NOTE: the "Access to hash password" issue is already covered by...

Debian DSA-585-1 : shadow - programming error

A vulnerability has been discovered in the shadow suite which provides programs like chfn and chsh. It is possible for a user, who is logged in but has an expired password to alter his account information with chfn or chsh without having to change the password. The problem was originally thought ...