USN-4998-1: Ceph vulnerabilities

It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive information. CVE-2020-25678 Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain...

SUSE-SU-2021:1960-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - Do not log passwords in logfiles bsc1184016...

SUSE-SU-2021:1959-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: - Fixed plaintext password entries in logfiles bsc1184016...

CVE-2021-25688

Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts of a user's password in the application logs...

Apache Airflow Encryption Problem Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security vulnerability exists in Apache Airflow versions prior to 1.10.13, which...

CVE-2020-17511

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field...

CVE-2020-17511

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field...

PYSEC-2020-262

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field...

CVE-2020-17511

CVE-2020-17511 affects Apache Airflow versions prior to 1.10.13. The vulnerability arises when creating a user (via airflow CLI) or a connection with a password field, causing the password to be logged in plaintext in the Log table in the Airflow metadata database. This issue is consistently desc...

CVE-2020-2004

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

Design/Logic Flaw

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...

CVE-2020-2004

The CVE-2020-2004 entry affects Palo Alto Networks GlobalProtect App prior to 5.0.9 (and 5.1 prior to 5.1.2 on Windows/macOS). The root cause is that, under specific conditions, a user’s password can be logged in cleartext in PanGPS.log when troubleshooting logs are collected (Save User Credentia...

Code injection

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered...

CVE-2020-11932 Subiquity server installer logged LUKS full disk encryption password

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered...

CVE-2016-11029

An issue was discovered on Samsung mobile devices with L5.0/5.1, M6.0, and N7.0 software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 December 2016...

CVE-2010-3282

CVE-2010-3282 covers a local information disclosure in HP-UX Directory Server and Red Hat Directory Server for HP-UX where audit logging logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, enabling local users to read sensitive data from logs....

Fedora 30 : freeipa (2019-8e9093da55)

FreeIPA 4.8.3 is a security update release that includes fixes for two issues : - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on...

CVE-2019-16210

Brocade SANnav vulnerable before v2.0 exposes a plain-text database connection password in logs when triggering the support save. Root cause is logging sensitive information; impact is information disclosure with high confidentiality risk. Remediation: upgrade SANnav to v2.0 or later (as noted in...

CVE-2019-14268

In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user in certain limited circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.3. The fix was back-porte...

Cross-Site Scripting (XSS)

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...