5450 matches found
CVE-2017-7729
On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext...
CVE-2017-5652
During a routine security analysis, it was found that one of the ports in Apache Impala incubating 2.7.0 to 2.8.0 sent data in plaintext even when the cluster was configured to use TLS. The port in question was used by the StatestoreSubscriber class which did not use the appropriate secure Thrift...
CVE-2017-5652
The CVE-2017-5652 entry concerns Apache Impala (incubating) versions 2.7.0–2.8.0 where one port used by the StatestoreSubscriber did not employ the secure Thrift transport when TLS was enabled. This allowed an attacker with network access to eavesdrop on plaintext data traversing that port, const...
Code injection
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245...
Schneider Electric Ampla MES
CVSS v3 6.7 ATTENTION: Low skill level to exploit. Vendor: Schneider Electric Equipment: Ampla MES Vulnerabilities: Cleartext Transmission of Sensitive Information, Inadequate Encryption Strength AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following Ampla...
CVE-2016-0238
IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409...
Cross site request forgery (csrf)
IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409...
CVE-2016-0238
IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409...
CVE-2016-0238
CVE-2016-0238 affects IBM Security Guardium 9.0/9.1/9.5 and 10.0/10.1 (including 10.1.2). Root cause: cleartext transmission of sensitive data in the query of the request, enabling potential MITM access to sensitive information. Impact: confidentiality impact (low per CVSS 3.0) with no integrity ...
Information disclosure
An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to...
CVE-2017-6028
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...
CVE-2017-6034
An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download...
CVE-2017-6034 Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay
An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download...
CVE-2017-6046
An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to...
CVE-2017-6034
CVE-2017-6034 affects Schneider Electric Modicon Modbus Protocol. The vulnerability is an Authentication Bypass by Capture-Replay, enabling an attacker to replay sensitive Modbus commands (run/stop/upload/download) with cleartext traffic and network access. The issue is associated with the Modico...
USN-3342-1: Linux kernel vulnerabilities
USN 3326-1 fixed a vulnerability in the Linux kernel. However, that fix introduced regressions for some Java applications. This update addresses the issue. We apologize for the inconvenience. It was discovered that a use-after-free flaw existed in the filesystem encryption subsystem in the Linux...
kernel: ipv4/tcp: Infinite loop in tcp_splice_read()
A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the splice and tcpspliceread functionality could allow a remote attacker to force the kernel to enter a condition in which it could loop indefinitely...
DEBIAN-CVE-2017-9445
In systemd through 233, certain sizes passed to dnspacketnew in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and...