CVE-2024-53865 Python package "zhmcclient" has passwords in clear text in its HMC and API logs

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

CVE-2024-53865

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

CVE-2024-53865 Python package "zhmcclient" has passwords in clear text in its HMC and API logs

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

PT-2024-35963

Name of the Vulnerable Software and Affected Versions: zhmcclient versions prior to 1.18.1 Description: The Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in several cases, including when creating or updating a partition in DPM mode, updating a...

CVE-2024-34162

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As...

CVE-2024-34162

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As...

CVE-2024-34162

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As...

CVE-2024-34162

The CVE-2024-34162 entry relates to Sharp MFPs (multifunction printers). The issue is that when LDAP authentication is configured to SIMPLE, the web interface communicates with the LDAP server in clear text, allowing retrieval of the LDAP password from that traffic. Public documents consistently ...

CVE-2024-34162: Access to Critical Private Variable via Public Method

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As...

PT-2024-25724 · Sharp +1 · Multiple Mfps

Name of the Vulnerable Software and Affected Versions: No specific product names, model numbers, or versions are mentioned in the provided descriptions. Description: The issue concerns the web interface of affected devices, which is designed to hide LDAP credentials from administrative users...

CVE-2018-9411

In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation...

SUSE CVE-2024-50293

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in smccreate Thanks to commit 4bbd360a5084 "socket: Print pf-create when it does not clear sock-sk on failure.", syzbot found an issue with AFSMC: smccreate must clear sock-sk on failur...

CVE-2024-10786: Missing Authorization

The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the slaclearusercache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-11118: Cross-Site Request Forgery (CSRF)

The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings function. This makes it possible for unauthenticated attackers to make changes to plug...

CVE-2021-34751

A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. This...

PT-2024-16545 · WordPress · Simple Local Avatars

Name of the Vulnerable Software and Affected Versions: The Simple Local Avatars plugin for WordPress versions up to, and including, 2.7.11 Description: The issue is related to a missing capability check on the sla clear user cache function, allowing authenticated attackers with Subscriber-level...

Intel BigDL security vulnerabilities

Intel BigDL is an application from Intel Corporation USA. A security vulnerability exists in Intel BigDL versions prior to 2.5.0 that originates from allowing sensitive information to be transmitted in clear text. An attacker exploiting this vulnerability could cause a denial of service on the...

freerdp: Integer overflow & OutOfBound Write in clear_decompress_residual_data

A flaw was found in FreeRDP-based clients. Affected versions of FreeRDP are vulnerable to an integer overflow and out-of-bounds write. This issue occurs when the sum of the runLengthFactor and pixelIndex values become large enough to overflow the uint32 type and bypass an error check when clearin...

kernel: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit

A flaw was found in the Linux kernel. The IH OVERFLOWCLEAR bit was not reset...

kernel: drm/radeon: check bo_va->bo is non-NULL before using it

A flaw was found in the Linux kernel's Radeon graphics driver. The driver fails to verify whether a memory buffer object pointer is valid before dereferencing it after freeing operations. A local user could exploit this flaw to cause a kernel crash, resulting in a Denial of Service DoS...