3540 matches found
Security Bulletin: Information Disclosure via IBM Spectrum Protect Plus virgo log file (CVE-2020-4477)
Summary IBM Spectrum Protect Plus virgo log file may disclose sensitive information in plain text. Vulnerability Details CVEID: CVE-2020-4477 DESCRIPTION: IBM Spectrum Protect Plus discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks...
F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...
CVE-2020-12023 Philips IntelliBridge Enterprise IBE Insertion of Sensitive Information into Log File
Philips IntelliBridge Enterprise IBE, Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns VS4, EarlyVue VS30 and IntelliVue Guardian IGS. Unencrypted user credentials received in the IntelliBridge Enterprise IBE are logged within the transaction logs, which are...
Information disclosure
An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'...
WhatsApp Phone Numbers Pop Up in Google Search Results — But is it a Bug?
UPDATE A researcher is warning that a WhatsApp feature called “Click to Chat” puts users’ mobile phone numbers at risk — by allowing Google Search to index them for anyone to find. But WhatsApp owner Facebook says it is no big deal and that the search results only reveal what the users have chose...
[SECURITY] Fedora 31 Update: python-markdown2-2.3.9-1.fc31
Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...
curl: Partial password leak over DNS on HTTP redirect
Summary: From version 7.62 curl and curllib leaks part of user credentials in the plain text DNS request. This happens if the server makes redirect, both 301 and 302 to a relative path eg header 'Location: /login'. It is NOT an issue in case of absolute redirection eg header 'Location:...
CVE-2019-13021
Bond JetSelect (all versions) stores administrator passwords in an unprotected filesystem file ( /opt/JetSelect/SFC/resources/sfc-general-properties ), instead of encrypting them in the database. The passwords are created via ENCtool.jar during installation and backed up by the installer, enablin...
Node.js third-party modules: [plain-object-merge] Prototype pollution
I would like to report a prototype pollution vulnerability in plain-object-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: plain-object-merge version: 1.0.1 npm page: https://www.npmjs.com/package/plain-object-merge Module Description Extremely fa...
Security Bulletin: A security vulnerability in IBM Websphere affects IBM Tivoli Netcool Performance Manager for Wireline (CVE-2013-0169)
Summary The Lucky Thirteen attack is a cryptographic timing attack against implementations of the Transport Layer Security TLS protocol that use the CBC mode of operation. An attacker could perform main in the middle attacks to successfully obtain plain text from the secure channel. Vulnerability...
CVE-2019-4668
IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...
CVE-2019-4668
IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...
Code injection
IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...
CVE-2019-4668
IBM UrbanCode Deploy UCD 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250...
CVE-2019-4668
CVE-2019-4668 affects IBM UrbanCode Deploy (UCD). The connected IBM security bulletin and NVD entry confirm that UCD stores user credentials in plaintext, readable by a local user, due to improper credential storage. Impact is confidentiality loss for credentials; exploitability is local. Remedia...
CVE-2019-19105 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentials
The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...
SMACom 1.2.0 Insecure Transit / Password Disclosure
Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-16 Vulnerability Laboratory ID VL-ID: ====================================...
Continued Exploitation of Pulse Secure VPN Vulnerability
Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix an arbitrary file reading vulnerability, known as CVE-2019-11510, can become compromised in an attack. 1 Although Pulse Secur...
SMACom v1.2.0 - Insecure Session Validation Vulnerability
Document Title: =============== SMACom v1.2.0 - Insecure Session Validation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2211 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID: ====================================...
