Design/Logic Flaw

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3743: Exposure of Sensitive Information to an Unauthorized Actor

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

Updated kodi packages fix security vulnerability

Updated Kodi package to fix world readable $HOME/.kodi directory which could potentially contain clear passwords for add-ons...

Avira Mobile Security for iOS Information Disclosure Vulnerability

Avira Mobile Security for iOS is a set of mobile security software based on the iOS platform from Avira Germany. An information disclosure vulnerability exists in iOS-based versions of Avira Mobile Security prior to 1.5.11, which originates when the program sends sensitive login information in...

Cisco Network Convergence System 5500 Series Routers Local Denial of Service Vulnerability

A vulnerability in the forwarding component of Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers could allow an authenticated, local attacker to cause the router to stop forwarding data traffic across Traffic Engineering TE tunnels, resulting in a denial of servic...

PT-2017-17228

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software for Cisco Network Convergence System NCS 5500 Series Routers version 6.2.11.BASE Description A vulnerability in the forwarding component could allow an authenticated, local attacker to cause the router to stop forwarding...

CVE-2017-9379

Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php...

CVE-2017-9379: Cross-Site Request Forgery (CSRF)

Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php...

PT-2017-18889

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue concerns multiple CSRF problems. Specifically, the clear parameter to "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and the from or to parameters to...

kernel security, bug fix, and enhancement update

3.10.0-514.21.1.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-514.21.1 - kernel sched/core: Fix an SMP ordering race in trytowakeup vs...

WebKit FrameLoader::clear Variable Theft

WebKit: Stealing variables via page navigation in FrameLoader::clear CVE-2017-2515 void FrameLoader::clearDocument newDocument, bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView mframe.editor.clear; if !mneedsClear return; mneedsClear = false; if...

CVE-2016-9750: Undefined Security Weakness

IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207...

Unspecified Vulnerability in Multiple Mozilla Products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

PT-2017-3800

Name of the Vulnerable Software and Affected Versions Moxa ioLogik 2542-HSPA versions 3.0 or lower Moxa Ioxpress Configuration Utility versions 2.3.0 or lower Description The issue is related to the use of an insecure cryptographic algorithm for storing and transmitting passwords in the Moxa...

Leakage Of Sensitive Data

github.com/influxdata/influxdb is vulnerable to leakage of sensitive data. The vulnerability is possible because passwords are revealed in clear text in influxhistory...

Gnome Keyring Daemon Credential Disclosure Vulnerability

The gnome-keyring-daemon is vulnerable to local credential disclosure as it leaves credentials accessible in memory. gnome-keyring-daemon is vulnerable to local credentials disclosure. Fortunately the attack can be spun on already compromised machines, but sadly, in those cases, an attacker can...

Mozilla: Out-of-bounds write in ClearKeyDecryptor (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin GMP sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data with...

BAIC's Android app has a CAPTCHA design flaw

BAIC Android app is an online mobile service software. A CAPTCHA design vulnerability exists in the BAIC Android app. The vulnerability is caused due to the captcha being transmitted in clear text and without conditional restrictions. With the password recovery feature, an attacker can continuous...

Unauthorized Access Vulnerability in MyPower-WNC6600 Series Wireless Controller

WNC6600 series is a new generation of wireless controller Access Controller -AC independently developed by Mapletree Technology Co. The wireless controller can centrally manage Fit APs and wireless clients. Unauthorized access vulnerability exists in MyPower-WNC6600 series wireless controllers,...