IBM Security Guardium Data Encryption (GDE) Plaintext Storage Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. A plaintext storage vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which can be...

RangeeOS Credentials Plaintext Storage Vulnerability

RangeeOS is a Linux operating system designed and developed specifically for thin clients, including all necessary software modules. A credentials plaintext storage vulnerability exists in multiple modules in RangeeOS 8.0.4. A local attacker with access to the underlying operating system could...

Schneider Electric Easergy Builder Sensitive Information Plaintext Storage Vulnerability (CNVD-2020-46566)

The Schneider Electric Easergy Builder is used by expert engineering teams to configure the T300 grid automation platform. Schneider Electric Easergy Builder 1.4.7.2 and earlier versions contain a sensitive information plaintext storage vulnerability that can be exploited by an attacker to access...

Easergy Builder Hardcoded Encryption Key Plaintext Storage Vulnerability

Schneider Electric Easergy Builder is a set of configuration software for Easergy remote terminal units and controllers from Schneider Electric, France. A security vulnerability exists in Schneider Electric Easergy Builder version 1.4.7.2 and prior versions. An attacker could exploit the...

GHSA-WVH7-5P38-2QFC Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

HCL BigFix Platform Credentials Plaintext Storage Vulnerability

HCL BigFix Platform is a suite of endpoint security management platform from HCL India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform that stems from the program storing credentials in...

Nextcloud -- Password share by mail not hashed

The Nextcloud project reports: NC-SA-2020-026 low: Password of share by mail is not hashed when given on the create share call A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call...

Password of share by mail is not hashed when given on the create share call (NC-SA-2020-026)

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call...

Kubernetes: Plaintext storage of a password on kubernetes release bucket

Report Submission Form Summary: During my recon I found these two buckets dl.k8s.io and dl.kubernetes.io which actually redirects to https://storage.googleapis.com/kubernetes-release/. By searching the string "password" under https://storage.googleapis.com/kubernetes-release/ I found a file calle...

ABB Telephone Gateway TG/S and Busch-Jaeger Telefon-Gateway Unprotected Credential Storage Vulnerability

The ABB Telephone Gateway TG/S and the Busch-Jaeger 6186/11 Telefon-Gateway are both a telephone gateway product from ABB Switzerland. A security vulnerability exists in the backup feature in ABB Telephone Gateway TG/S version 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway, which stems from the...

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. Recent assessments: theguly at March 12, 2020 3:39pm UTC reported: i love these type of vulnerabilities because they chain three findings normally...

Arista Networks CloudVision Portal Memory Corruption Vulnerability

Arista Networks CloudVision Portal is a suite of web-based user management portals for the CloudVision platform from Arista Networks, USA. The product includes features such as network device configuration, compliance management, change management, and network monitoring and management. A securit...

GitLab EE Token Plaintext Storage Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. A token explicit storage vulnerability exists in GitLab EE 8...

Intesync Solismed Encryption Issue Vulnerability

Intesync Solismed is a clinic management system from Intesync USA. An encryption issue vulnerability exists in Intesync Solismed version 3.3sp1. The vulnerability stems from a web-based system or product that does not properly use relevant cryptographic algorithms, resulting in content that is no...

SQL injection vulnerability in 162100 Simplex Forum System of Shenyang Huanggu District Ainong Network Technology Service Center

Huanggu District, Shenyang City, love thick network technology service center simple forum system is a forum website building system. Shenyang Huanggu District, Shenyang City, love thick network technology service center 162100 simple forum system there are SQL injection vulnerabilities, attacker...

Jenkins iceScrum Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins iceScrum. Authentication is required to exploit this vulnerability. The specific flaw exists within the iceScrum plugin. The issue results from storing credentials in plaintext. An...

(0Day) Jenkins View26 Test-Reporting Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins View26 Test-Reporting. Authentication is required to exploit this vulnerability. The specific flaw exists within the View26 Test-Reporting plugin. The issue results from storing...

Jenkins Port Allocator Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins Port Allocator. Authentication is required to exploit this vulnerability. The specific flaw exists within the Port Allocator plugin. The issue results from storing credentials in...

Jenkins Gogs Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins Gogs. Authentication is required to exploit this vulnerability. The specific flaw exists within the Gogs plugin. The issue results from storing credentials in plaintext. An attacker ca...

Jenkins eggPlant Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins eggPlant. Authentication is required to exploit this vulnerability. The specific flaw exists within the eggPlant plugin. The issue results from storing credentials in plaintext. An...