413 matches found
CVE-2018-19466
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls...
Design/Logic Flaw
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls...
CVE-2018-19466
Portainer before 1.20.0 stores LDAP credentials (master password) in cleartext and exposes a means to retrieve them via API calls. The issue, as described, affects Portainer’s handling of LDAP data and could lead to exposure of sensitive credentials if an attacker can access the API. No exploitat...
CVE-2018-19466
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls...
CVE-2018-19466: Insufficiently Protected Credentials
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls...
Portainer has an unspecified vulnerability (CNVD-2019-40492)
Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A security vulnerability exists in Portainer 1.19.2 and earlier versions, which stems from an API endpoint used for authentication returning 404 when an administrator has not been created, and...
CVE-2018-19367
Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...
CVE-2018-19367
Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...
Design/Logic Flaw
Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...
CVE-2018-19367
Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...
CVE-2018-19367
Portainer
CVE-2018-19367: Undefined Security Weakness
Portainer through 1.19.2 provides an API endpoint /api/users/admin/check to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case...
PT-2018-14942
Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.19.3 Description The issue allows attackers to set an admin password under certain conditions. Specifically, it involves the API endpoint "/api/users/admin/check" which checks if the admin user is already created...
Portainer Cross-Site Scripting Vulnerability
Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A cross-site scripting vulnerability exists in Portainer 1.19.1 and earlier versions, which can be exploited by remote attackers to inject arbitrary JavaScript code and or HTML with the help of...
Cross-site Scripting (XSS)
github.com/portainer/portainer is vulnerable to cross-site scripting XSS attacks. The library does not use HTTP Secure Headers, allowing a malicious user to inject and execute arbitrary Javascript through the Team Name field...
Cross site scripting
A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...
CVE-2018-16316
A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...
CVE-2018-16316
A stored Cross-site scripting XSS vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field...
CVE-2018-16316
CVE-2018-16316 describes a stored XSS in Portainer up to version 1.19.1, exploitable by remote authenticated users via the Team Name field. The issue stems from unvalidated input stored and rendered in teams management; real-world impact is arbitrary JavaScript/HTML execution for affected users. ...