3357 matches found
Open redirect
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input...
Design/Logic Flaw
In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host...
CVE-2022-28161
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need t...
GHSA-XV7J-2V4W-CJVH OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
Authentication flaw
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
BSA-2022-1840
Security Advisory ID : BSA-2022-1840 Component : debug mode Revision : 1.0 An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in...
Security Bulletin: IBM InfoSphere Master Data Management Reference Data Management Hub is affected by a user password being stored in plain text vulnerability (CVE-2017-1309)
Summary IBM InfoSphere Master Data Management Reference Data Management Hub has addressed the following vulnerability. IBM InfoSphere Master Data Management Reference Data Management Hub stores user credentials in plain text which can be read by a local user. Vulnerability Details CVEID:...
Internet Bug Bounty: CVE-2022-27774: Credential leak on redirect
Summary: curl/libcurl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...
PT-2022-7282 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authenticatio...
Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22876)
Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22876 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to strip off user credentials from the URL when automatically populating the...
Dell EMC Password Storage Vulnerability
Dell EMC is a repository manager. A plain text password storage vulnerability exists in Dell EMC. A local attacker could exploit this vulnerability to cause the disclosure of certain user credentials. An attacker could use this vulnerability to be able to use publicly available credentials to...
CVE-2022-26856
Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable...
Design/Logic Flaw
Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable...
CVE-2022-26856
Dell EMC Repository Manager (version 3.4.0) contains a plain-text password storage vulnerability. A local attacker could disclose credentials and use them to access the vulnerable application's database with privileges of the compromised account. The available documents do not specify exploit cod...
CVE-2022-26856
Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable...
IBM Security Guardium Information Disclosure Vulnerability (CNVD-2022-46308)
IBM Security Guardium is a suite of platforms from IBM USA that provides data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium is vulnerable to an information disclosure vulnerability that...
PT-2022-3567
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration aka ZCS versions 8.8.15 through 9.0.0 Description The issue allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, causing an overwrite of arbitrary cached entries. This can be...
CVE-2021-39078
IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589...