Security Bulletin: IBM Verify Gateway PAM components default to cleartext storage of client secret (CVE-2020-4369)

Summary The IBM Verify Gateway IVG PAM components allow encryption of the client-secret property in the /etc/pamibmauth.json file, but it's not the default configuration. Instead, customers must remember to add an --obfuscation command-line flag to encrypt the property. As of v1.0.1 of IVG for AI...

FreeBSD : salt -- multiple vulnerabilities (a1e03a3d-7be0-11eb-b392-20cf30e32f6d)

SaltStack reports multiple security vulnerabilities in Salt - CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via sshoptions provided in an API request. - CVE-2021-25281: The Salt-API does not have eAuth credentials for the...

Potential sensitive information can be displayed in cleartext in FortiProxy CLI window

...

CVE-2021-26564

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26565

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session...

CVE-2021-26565

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session...

CVE-2021-26564

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

Design/Logic Flaw

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

Session fixation

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session...

Design/Logic Flaw

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26565

Synology DiskStation Manager (DSM) prior to version 6.2.3-25426-3 contains a cleartext transmission vulnerability in synorelayd that can allow MITM attackers to obtain sensitive information via HTTP sessions. The issue affects DSM running on Synology NAS devices and is documented in multiple sour...

CVE-2021-26565

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session...

CVE-2021-26564

CVE-2021-26564 is a vulnerability in Synology DiskStation Manager (DSM) due to cleartext transmission in the synorelayd component prior to version 6.2.3-25426-3. The flaw allows man-in-the-middle attackers to spoof servers via an HTTP session, exposing sensitive information. Connected sources ali...

CVE-2021-26564

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26560

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session...

CVE-2021-26560

CVE-2021-26560 affects Synology DiskStation Manager (DSM) prior to 6.2.3-25426-3 via the synoagentregisterd service. The issue involves cleartext HTTP transmission during server discovery (the /finder/server response and subsequent domain parsing), enabling MITM disclosure and server spoofing. TA...

CVE-2021-25284

A flaw was found in salt. Webutils write passwords in cleartext to /var/log/salt/minion...

PT-2021-17043 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue concerns the cleartext transmission of sensitive information in the synorelayd component of Synology DiskStation Manager DSM. This allows man-in-the-middl...