CVE-2021-39077 IBM Security Guardium information disclosure

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215587...

CVE-2022-34339: Cleartext Storage of Sensitive Information

"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."...

CVE-2022-34339

"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."...

CVE-2021-39077

CVE-2021-39077 affects IBM Security Guardium 10.5, 10.6, 11.0–11.4. The root cause is that Guardium stores user credentials in plaintext, allowing a local privileged user to read them. This vulnerability is documented in IBM/Red Hat advisories and is assigned an X-Force ID of 215587. Remediation ...

CVE-2022-34339

"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963."...

CVE-2022-34339

CVE-2022-34339 affects IBM Cognos Analytics 11.2.x and 11.1.x, where credentials are stored in plain text readable by an authenticated user. Root cause: cleartext credential storage. Impact: information disclosure (confidentiality High). Remediation: upgrade to IBM Cognos Analytics 11.2.3 or 11.1...

CVE-2022-40190

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

Cross site scripting

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

CVE-2022-40190

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting XSS. The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive...

Bazel leaks user credentials through the remote assets API

...

CVE-2022-3474 Bazel leaks user credentials through the remote assets API

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...

CVE-2022-26423

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-27494

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-1059

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

Default credentials

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

Default credentials

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

Default credentials

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-27494 CROSS-SITE SCRIPTING CWE-79

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...

CVE-2022-27494

CVE-2022-27494 affects Aethon TUG Home Base Server prior to version 24. The vulnerability is a cross-site scripting (stored XSS) in the Reports tab of the Fleet Management Console, caused by insufficient input sanitization in the Reports component. An unauthenticated attacker could inject JavaScr...

CVE-2022-1070 CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials...