1688 matches found
PYSEC-2020-39
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
Authentication flaw
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
CVE-2020-15105
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
PYSEC-2020-39
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
CVE-2020-15105 In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
CVE-2020-15105
Django Two-Factor Authentication (django-two-factor-auth) vulnerability CVE-2020-15105 affects versions up to 1.11. It stores the user’s password in clear text (base64-encoded) in the user session after the user submits credentials, until authentication completes via a 2FA code. Depending on sess...
GHSA-VHR6-PVJM-9QWF User passwords are stored in clear text in the Django session
Impact django-two-factor-auth versions 1.11 and before store the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
User passwords are stored in clear text in the Django session
Impact django-two-factor-auth versions 1.11 and before store the user's password in clear text in the user session base64-encoded. The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor...
CDATA OLTs Backdoor / Privilege Escalation / Information Disclosure
Hello, Please find a text-only version below sent to security mailing lists. The complete version on "Multiple vulnerabilities found in CDATA OLTs" is posted here: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html === text-version of the advisory === -----BEGIN PGP...
CVE-2019-4676
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512...
CVE-2020-12040
Sigma Spectrum Infusion System v's6.x model 35700BAX and Baxter Spectrum Infusion System Versions 8.x model 35700BAX2 at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has...
CVE-2020-12040
Sigma Spectrum Infusion System v's6.x model 35700BAX and Baxter Spectrum Infusion System Versions 8.x model 35700BAX2 at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has...
CVE-2019-18248
BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker can disclose the product’s client credentials for connecting to the BIOTRONIK Remote Communication infrastructure...
CVE-2019-18248
BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker can disclose the product’s client credentials for connecting to the BIOTRONIK Remote Communication infrastructure...
Design/Logic Flaw
BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker can disclose the product’s client credentials for connecting to the BIOTRONIK Remote Communication infrastructure...
CVE-2019-18248
CVE-2019-18248 affects BIOTRONIK CardioMessenger II. The vulnerability involves cleartext transmission of credentials prior to switching to an encrypted channel, enabling an adjacent attacker to disclose the client credentials used to connect to the BIOTRONIK Remote Communication infrastructure. ...
CVE-2019-18248
BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker can disclose the product’s client credentials for connecting to the BIOTRONIK Remote Communication infrastructure...
CVE-2020-12040
Sigma Spectrum Infusion System v's6.x model 35700BAX and Baxter Spectrum Infusion System Versions 8.x model 35700BAX2 at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has...
CVE-2020-12040
CVE-2020-12040 affects Sigma Spectrum Infusion System v6.x (model 35700BAX) and Baxter Spectrum Infusion System v8.x (model 35700BAX2); root cause is unauthenticated clear-text transmission of system status and operational data at the application layer, enabling eavesdropping or MiTM if network c...
Information Disclosure
github.com/jaegertracing/jaeger is vulnerable to information disclosure. The vulnerability exists as it was logging clear text passwords, of kerberos and plaintext authentication, in the kafka producer...