157 matches found
Client secret transmitted in plain text by Azure AD Plugin
Azure AD Plugin stores a client secret in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions,...
Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by S3 publisher Plugin 0.11.4 and earlier. This can result in exposure of the credential through browser...
GHSA-793W-Q2H5-8H5J Jenkins QMetry for JIRA Plugin shows plain text password in configuration form
Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result...
Jenkins QMetry for JIRA Plugin shows plain text password in configuration form
Jenkins QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result...
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions,...
GHSA-PXV2-MFQ7-VHP6 Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions,...
Exposure of Sensitive Information in Jenkins Datadog plugin
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser...
GHSA-HF7W-F4H4-9XP8 Exposure of Sensitive Information in Jenkins Datadog plugin
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser...
CVE-2022-28795
A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then...
Design/Logic Flaw
A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then...
CVE-2022-28795
CVE-2022-28795 affects Avira Password Manager Browser Extensions (Chrome, Edge, Opera, Firefox, Safari). A loophole could allow an attacker-supplied page to trigger the extension to autofill the password field, enabling access via JavaScript. The issue was fixed in extensions version 2.18.5 (Chro...
CVE-2022-28795
A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then...
Avira Password Manager Browser Extensions 安全漏洞
Avira Password Manager Browser Extensions is a password management software by Little Red Umbrella, which is designed for chrome and can also be used on edge browsers to ensure that users can manage their passwords on the web. A security vulnerability exists in Avira Password Manager Browser...
CVE-2022-0815
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system. This could lead to unexpected behaviors including; settings being changed...
Microsoft Edge browser extensions are not retained in Citrix user profile
Microsoft EDGE browser extensions are not being saved to the users' Citrix Profile Management user store folder...
The vulnerability of Google Chrome browser extensions, which allows a hacker to execute arbitrary code.
The vulnerability of Google Chrome’s browser extensions is caused by an overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page from a remote location...
The best browsers for privacy and security
Unfortunately there is a low correlation factor between what most people find the best browsers and what are the best browsers when it comes to privacy and security. If you look at the market share of the most popular browsers, there is one browser that steals the crown without a lot of...
Raccoon Stealer Bundles Malware, Propagates Via SEO
Criminals behind the Raccoon Stealer platform have updated their services to include tools for siphoning cryptocurrency from a target’s computer and new remote access features for dropping malware and scooping up files. The stealer-as-a-service platform, whose customers are typically rookie...
What is scareware?
Scareware is a type of rogue program which has been around for many years, arguably dating back to 1990. It can be installed without permission, or via deception and false promises. Scareware is primarily used to panic or worry someone into performing a task they otherwise wouldn’t have done. The...
