3357 matches found
CVE-2018-1000410
An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with...
The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.
The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...
3S-Smart Software Solutions GmbH CODESYS Control V3 Products
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : 3S-Smart Software Solutions GmbH Equipment : CODESYS Control V3 products Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...
CVE-2018-16092
In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...
Spotify Phishers Hijack Music Fans' Accounts
A phishing campaign with a clever Spotify lure has been spotted trying to harvest user credentials for the popular streaming service. Researchers at AppRiver detected the offensive earlier this month, in a campaign looking to compromise Spotify customers using bogus – but convincing – emails with...
Information Disclosure
kibana is vulnerable to information disclosure. An improperly initialized kibana login screen causes user-entered credentials to be shown in the URL bar and allows untrusted parties to obtain the user's credentials via access logs or through the Referer header when the user browses to another...
CVE-2018-16162
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...
Default credentials
OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via unspecified vectors...
CVE-2018-16162
CVE-2018-16162 affects OpenDolphin, versions 2.7.0 and earlier. The vulnerability allows authenticated attackers to obtain other users’ credentials (e.g., user IDs and passwords) through unspecified vectors, resulting in information disclosure with partial to high impact on confidentiality and, p...
WordPress 4.6.x < 4.6.6 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
WordPress 4.4.x < 4.4.10 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
WordPress 4.3.x < 4.3.11 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...
The vulnerability in the FortiOS operating system’s web portal allows a hacker to expose user credentials.
The vulnerability of the FortiOS operating system’s web portal relates to the storage of user credentials in an exposed manner. Exploiting this vulnerability allows a malicious actor to disclose user credentials remotely...
PT-2018-3117
Name of the Vulnerable Software and Affected Versions Modicon M340, Modicon Quantum, and Modicon Premium affected versions not specified Description The issue is related to the implementation of the FTP protocol in the firmware of Modicon M340, Modicon Quantum, and Modicon Premium programmable...
Code injection
IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...
CVE-2017-1231
IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...
CVE-2017-1231
IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...
CVE-2017-1231
CVE-2017-1231 affects IBM BigFix Platform 9.5 (9.5.0 to 9.5.9). The root cause is storing user credentials in plaintext on the server, allowing a local attacker to read them. Public references from NVD/CNVD/Nessus indicate an information-disclosure vulnerability with high impact when exposed loca...