CVE-2014-0920

IBM SPSS Analytic Server versions 1.0.0.0 (before IF002) and 1.0.1.0 (before IF004) are affected by CVE-2014-0920, which causes logs to contain passwords in plaintext, allowing authenticated remote users to obtain sensitive information via unspecified vectors. The vulnerability is addressed by IB...

CVE-2014-2212

The remember me feature in portal/scrauthentif.php in POSH aka Posh portal or Portaneo 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie...

Default credentials

The remember me feature in portal/scrauthentif.php in POSH aka Posh portal or Portaneo 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie...

CVE-2014-2212

The remember me feature in portal/scrauthentif.php in POSH aka Posh portal or Portaneo 3.0, 3.2.1, 3.3.0, and earlier stores the username and MD5 digest of the password in cleartext in a cookie, which allows attackers to obtain sensitive information by reading this cookie...

CVE-2014-2212

POSH (POSH portal / Portaneo) is affected by multiple CVEs in 2014. CVE-2014-2211 describes an SQL injection in portal/addtoapplication.php via the rssurl parameter, enabling remote arbitrary SQL execution for POSH versions 3.0 before 3.3.0. CVE-2014-2212 reports a separate issue where the rememb...

Canon PIXMA MX722 Printer Wireless Password Disclosure

Affects: Canon PIXMA MX722 Printer and probably other Canon printers. After typing my WPA2 WiFi password into the printer through the built-in hardware keypad, it exposes the cleartext password to the LAN through an admin page that isn't password protected:...

CVE-2013-5445

IBM Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1 allows local users to obtain sensitive cleartext information by leveraging knowledge of a static decryption key...

CVE-2014-2567

The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a 1 sent or 2 draft folder via a PREAUTH response that prevents later use of the STARTTLS comman...

Command injection

The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a 1 sent or 2 draft folder via a PREAUTH response that prevents later use of the STARTTLS comman...

CVE-2014-2567

The vulnerability CVE-2014-2567 affects Trojita prior to 0.4.1. The issue is in OpenConnectionTask::handleStateHelper in Trojita’s IMAP code, where a PREAUTH response can be exploited by a man-in-the-middle to force saving a message into the sent or draft folder over plaintext, bypassing STARTTLS...

Mandriva Linux Security Advisory : imapsync (MDVSA-2014:060)

Updated imapsync package fixes security vulnerabilities : Imapsync, by default, runs a release check when executed, which causes imapsync to connect to http://imapsync.lamiral.info and send information about the version of imapsync, the operating system and perl CVE-2013-4279. The imapsync packag...

CVE-2014-0694

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

Design/Logic Flaw

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

CVE-2014-0694

Intelligent Automation for Cloud IAC in Cisco Cloud Portal 9.4.1 and earlier includes a cryptographic key in binary files, which makes it easier for remote attackers to obtain cleartext data from an arbitrary IAC installation by leveraging knowledge of this key, aka Bug IDs CSCui34764, CSCui34772...

CVE-2014-0694

Cisco Intelligent Automation for Cloud (IAC) in Cisco Cloud Portal 9.4.1 and earlier contains fixed cryptographic material in binary files, enabling remote attackers to obtain cleartext data from any IAC installation with knowledge of the embedded key. Impact is confidential data leakage due to c...

Apple TV Touch Password Disclosure

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Intrepidus Group Security Advisory http://www.intrepidusgroup.com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Title: Apple TV Touch Setup Wi-Fi and iTunes Password Disclosure Release Date: 10 March...

CVE-2014-0890

The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, 8.5.2.1, 9.0, and 9.0.0.1, when a certain com.ibm.collaboration.realtime.telephony..level setting is used, logs cleartext passwords during Audio/Video chat sessions, which allows local users to obtain sensitive information by...

MGASA-2014-0106 Updated imapsync package fixes CVE-2014-2014

Updated imapsync package fixes security vulnerability: In imapsync before 1.584, a certificate verification failure when using the --tls option results in imapsync attempting a cleartext login CVE-2014-2014...

CVE-2014-1467

BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise...

Design/Logic Flaw

BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise...