GHSA-65M9-M259-7JQW Improper Authorization in react-oauth-flow

All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendation No fix ...

Cisco Meetings App Authorization Issues Vulnerability

Cisco Meetings App is a video conferencing application from Cisco USA. An authorization issue vulnerability exists in the API subsystem in Cisco Meetings App, which stems from a flaw in the protection mechanism for TURN server credentials. A remote attacker can exploit this vulnerability by...

Security Bulletin: IBM InfoSphere BigInsights affected by multiple vulnerabilities in alert module (CVE-2014-4781, CVE-2014-4782)

Summary Security vulnerabilities have been identified in the alert module of InfoSphere BigInsights that could allow an attacker to obtain information from the Alert management services. Vulnerability Details CVE-ID: CVE-2014-4781 DESCRIPTION: IBM InfoSphere BigInsights could allow an attacker to...

CVE-2020-3197

The CVE-2020-3197 entry concerns Cisco Meetings App: an API subsystem vulnerability that allows an unauthenticated, remote attacker to obtain and reuse TURN server credentials by intercepting legitimate traffic due to insufficient protection of those credentials. Impact described: attacker could ...

CVE-2020-3197: Improper Authentication

A vulnerability in the API subsystem of Cisco Meetings App could allow an unauthenticated, remote attacker to retain and reuse the Traversal Using Relay NAT TURN server credentials that are configured in an affected system. The vulnerability is due to insufficient protection mechanisms for the TU...

Information Disclosure Vulnerability in Multiple Rockwell Automation Products

Rockwell Automation MicroLogix 1400 Controllers Series A and so on are the products of Rockwell Automation, Inc.Rockwell Automation MicroLogix 1400 Controllers Series A is a programmable logic controller.MicroLogix 1100 Controllers is a programmable logic controller.RSLogix 500 Software is a set ...

Improper Authorization

Overview All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendatio...

CVE-2019-15635

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...

Unspecified Vulnerability in JetBrains IntelliJ IDEA Ultimate

JetBrains IntelliJ IDEA Ultimate is a Czech JetBrains integrated development environment for the Java language. A security vulnerability exists in JetBrains IntelliJ IDEA Ultimate that originates from the program logging server credentials in plaintext to the IDE configuration file. An attacker...

CVE-2019-9872

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize...

CVE-2019-9873

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8...

CVE-2019-9823

In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8...

UBUNTU-CVE-2019-9873

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8...

CVE-2019-9872

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize...

CVE-2019-9823

In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8...

CVE-2019-9823: Cleartext Storage of Sensitive Information

In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8...

CVE-2018-13374: Incorrect Permission Assignment for Critical Resource

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the...

CVE-2018-10814

Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials...

Security Bulletin: IBM API Connect server credentials used for a specific restricted scenario may have been exposed (CVE-2016-3012)

Summary IBM API Connect server credentials used for a specific restricted scenario that is internal and do not involve authentication may have been exposed and packaged in the toolkit. Vulnerability Details CVEID: CVE-2016-3012 DESCRIPTION: IBM API Connect server credentials used for an internal...

CVE-2017-2747

HP has identified a potential security vulnerability before IG110000.10 for DesignJet T790, T795, T1300, T2300, before MRY040500.5 for DesignJet T920, T930, T1500, T1530, T2500, T2530, before AENEAS030400.9 for DesignJet T3500, before NEXUS011200.11 for Latex 310, 330, 360, 370, before...