Gajim: Information disclosure

Background Gajim is a Jabber/XMPP client which uses GTK+. Description Gajim unconditionally implements the “XEP-0146: Remote Controlling Clients” extension. Impact Remote attackers, by enticing a user to connect to a malicious XMPP server, could extract plaintext from Off The Record OTR encrypted...

IBM Integration Bus Information Disclosure Vulnerability (CNVD-2017-22088)

IBM Integration Bus formerly known as IBM WebSphere Message Broker is an enterprise service bus ESB product from IBM. The product provides connectivity and common data transformations for Service Oriented Architecture SOA environments and non-SOA environments. An information disclosure...

CVE-2017-1207

IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777...

CVE-2017-7315

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...

Default credentials

An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin...

CVE-2017-7315

CVE-2017-7315 concerns Humax Digital HG100R devices (version 2.0.6). The vulnerability enables download of the backup file without authentication, and GatewaySettings.bin includes the router credentials in plaintext. This exposes sensitive credentials and configuration to an attacker who can obta...

Humax Digital HG100R Backup File Download Vulnerability

The Humax Digital HG100R is a router from the Korean company Humax Digital. A security vulnerability exists in the Humax Digital HG100R version 2.0.6. The vulnerability can be exploited by an attacker to download a backup file and obtain the router certificate in plaintext...

tpm2-tools Authentication Authorization Vulnerability

tpm2-tools is a toolkit for monitoring trusted platform modules in Linux. A security vulnerability exists in versions of tpm2-tools prior to 1.1.1, which stems from the program passing passwords from the client to the server in plaintext. An attacker could exploit the vulnerability to obtain...

OSRAM SYLVANIA Osram Lightify Home Information Disclosure Vulnerability

OSRAM SYLVANIA Osram Lightify Home is an open IoT platform for automated control of lighting devices from German company OSRAM. A security vulnerability exists in OSRAM SYLVANIA Osram Lightify Home versions prior to 2016-07-26, which originates from the program storing the PSK in plaintext in the...

Check_MK < 1.4.0p6 webapi.py XSS

The version of CheckMK running on the remote web server is prior to 1.4.0p6. It is, therefore, affected by a reflected cross-site XSS scripting vulnerability in webapi.py due to error messages being interpreted as HTML when they should be plain text. An unauthenticated, remote attacker can exploi...

DEBIAN-CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

UBUNTU-CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

Design/Logic Flaw

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

CVE-2017-7524 affects tpm2-tools before 1.1.1, where a password is transmitted in plaintext from client to server when generating an HMAC, enabling a potential password leak. Publicly documented details across connected sources confirm the affected component and root cause, with several advisorie...

Code injection

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The CVE-2017-3214 entry concerns the Milwaukee ONE-KEY Android app, where the master token is stored in plaintext inside the APK binary. Connected sources corroborate this as part of a broader set of findings in IoT security testing: the master credentials are needed to obtain a bearer token, whi...