Design/Logic Flaw

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device...

CVE-2022-20660

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device...

Cisco IP Phone 安全漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phones that provide calling capabilities. A security vulnerability exists in the Cisco IP Phones that results from unencrypted storage of confidential information on the affected devices. An attacker could exploit this...

PT-2021-4620 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center Software affected versions not specified Description: A vulnerability in the administrative web-based GUI configuration manager could allow an authenticated, remote attacker to access sensitive configuration...

PT-2021-14724 · Jenkins · Jenkins Nomad Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Nomad Plugin versions 0.7.4 and earlier Description: The issue allows Docker passwords to be stored unencrypted in the global config.xml file on the Jenkins controller. These passwords can be viewed by users with access to the Jenkins...

Unencrypted storage of client side sessions

Impact The default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. Note: the documentation does point this out and...

CVE-2021-29481 Client side sessions should not allow unencrypted storage

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

CVE-2021-29956

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

CVE-2021-29956

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

The vulnerability of the production automation system’s System Platform, related to the storage of confidential information in unencrypted form, may allow a hacker to gain access to user account data.

The vulnerability of the production automation system’s platform lies in the storage of confidential information in an unencrypted form. Exploiting this vulnerability could allow attackers to gain access to user account information...

Mozilla: Thunderbird stored OpenPGP secret keys without master password protection

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

Mozilla: Thunderbird stored OpenPGP secret keys without master password protection

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

Mozilla: Thunderbird stored OpenPGP secret keys without master password protection

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

The vulnerability of the Thunderbird email client, related to the unencrypted storage of OpenPGP keys, allows attackers to gain access to confidential information.

The vulnerability of the Thunderbird email client is related to the unencrypted storage of OpenPGP keys. Exploiting this vulnerability could allow an attacker to access confidential information...

The vulnerability of microprogrammed network devices such as ZyXEL USG, USG VPN, ATP, ZyWALL, and FLEX lies in the unencrypted storage of data, which allows attackers to gain unauthorized access to protected information.

The vulnerability of microprogrammed network devices such as ZyXEL USG, USG VPN, ATP, ZyWALL, and FLEX lies in the unencrypted storage of data when the “zyfwp” account is used. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information from a...

The vulnerability of the CmtViewer application, which manages programmable panels, stems from the storage of protected information in an unencrypted form. This allows a perpetrator to gain access to the protected information.

The vulnerability of the CmtViewer application for controlling programmable panels lies in the storage of protected information in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to gain access to the protected information remotely...

The vulnerability of the EasyBuilder engineering software lies in the fact that protected information is stored in an unencrypted form, allowing a perpetrator to gain access to the device.

The vulnerability of the EasyBuilder engineering software lies in the storage of sensitive information in an unencrypted form. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

CVE-2020-2291

Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2020-2249

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...

PT-2020-6757 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions of the /opt/axess/etc/default/axess file in the Zyxel CloudCNM SecuManager software, which is used for centralized device management...