CVE-2024-22388

CVE-2024-22388 affects HID Global devices configured as encoders (e.g., iCLASS SE CP1000 Encoder, iCLASS SE Readers/Modules/Processors, OMNIKEY 5427CK/5127CK/5023/5027). Root cause: improper authorization in the encoder communication channel enables exposure of sensitive data when reader configur...

SUSE CVE-2018-0886

The Credential Security Support Provider protocol CredSSP in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code...

Malicious code in dup-glob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b708cc446795b7fc915527c5b980edfa8ea6bf147655f4d91aa79f8e2b29fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2022-2253)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempti...

GHSA-44W7-GH9C-4QVR Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the CredentialdoValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

The vulnerability of the Credential Security Support Provider Protocol (CredSSP) implementation in the Windows operating system allows a perpetrator to enhance their privileges.

The vulnerability of the Credential Security Support Provider Protocol CredSSP implementation in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2021-41366

Credential Security Support Provider Protocol CredSSP Elevation of Privilege Vulnerability...

CVE-2021-41366

Credential Security Support Provider Protocol CredSSP Elevation of Privilege Vulnerability...

CVE-2021-41366

CVE-2021-41366 : Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege. The NVD entry reports a high-severity (CVSS 3.1 base 7.8) vulnerability with a LOCAL attack vector, requiring LOW privileges and NO user interaction, leading to HIGH impact on confidentiality, integri...

CVE-2021-41366 Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

...

Microsoft Windows Multiple Vulnerabilities (KB5007206)

This host is missing a critical security update according to Microsoft KB5007206 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

...

PT-2021-5261 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the Credential Security Support Provider Protocol CredSSP in the Windows operating system, specifically concerning insecure privilege management. This allows an...

Microsoft Windows 权限许可和访问控制问题漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows Cred SSProvider Protocol with privilege permission and access control issues. The following products and editions are affected: Windows...

CloudBees Jenkins Team Foundation Server Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

LokiBot Malware

Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework. See the ATT&CK for Enterprise frameworks for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency CISA with contributions...

CVE-2014-4659

Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format...

CVE-2019-10443

CVE-2019-10443 affects Jenkins iceScrum Plugin up to version 1.1.4, where credentials are stored unencrypted in job config.xml on the Jenkins master. This enables access by users with Extended Read permission or access to the master filesystem, per multiple advisories (ZDI-19-933, Jenkins securit...

CVE-2019-0032 Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.

A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...

CVE-2019-10845

An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product, a pop-up window will appear asking the user if they want to save these new credentials. The code of the pop-up window can be read and, to some extent,...