CVE-2021-3413: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in Red Hat Satellite in tfm-rubygem-foremanazurerm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity ...

PT-2021-20387

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite tfm-rubygem-foreman azure rm versions prior to 2.2.0 Description: A flaw in Red Hat Satellite's tfm-rubygem-foreman azure rm component can lead to a credential leak, exposing Azure Resource Manager's secret key through JSON ...

DEBIAN-CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header...

CVE-2021-22876: Exposure of Private Personal Information to an Unauthorized Actor

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header...

CVE-2019-10225: Insufficiently Protected Credentials

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and...

CVE-2021-3413

A flaw was found in Red Hat Satellite. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2020-35558

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials...

PT-2021-4570

Name of the Vulnerable Software and Affected Versions curl versions 7.1.1 through 7.75.0 Description The issue is related to the exposure of private personal information to an unauthorized actor by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from t...

CentOS 8 : git (CESA-2020:1513)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1513 advisory. - git: Crafted URL containing new lines can cause credential leak CVE-2020-5260 Note that Nessus has not tested for this issue but has instead relied only on th...

IBM Jazz Foundation 跨站脚本漏洞

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines Corporation IBM. A cross-site scripting vulnerability exists in IBM Jazz Foundation products that allows a user to embed arbitrary JavaScript code in the Web UI to...

IBM Engineering Test Management Cross-Site Scripting Vulnerability (CNVD-2021-03016)

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management, with broad coverage of all aspects from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management. An...

ASB-A-169763814

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...

PT-2020-16262

Name of the Vulnerable Software and Affected Versions Genexis Platinum 4410 Router version V2.1 P4410-V2–1.34H Description The UPNP Service listening on port 5555 has an action X GetAccess which leaks the credentials of the admin account, provided that the attacker is network adjacent...

CVE-2020-25988: Cleartext Transmission of Sensitive Information

UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 P4410-V2–1.34H has an action 'XGetAccess' which leaks the credentials of 'admin', provided that the attacker is network adjacent...

CVE-2020-9982

Apple Music for Android (version 3.4.0) fixes a vulnerability where a malicious application could leak a user's credentials. The issue was mitigated by improved checks to prevent unauthorized actions. Affected product: Apple Music on Android; root cause details are not fully disclosed in the avai...

PT-2020-20917

Name of the Vulnerable Software and Affected Versions Apple Music versions prior to 3.4.0 for Android Description A malicious application may be able to leak a user's credentials due to insufficient checks, allowing unauthorized actions. Recommendations For Apple Music versions prior to 3.4.0 for...

CVE-2020-9982: Undefined Security Weakness

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0 for Android. A malicious application may be able to leak a user's credentials...

About the security content of Apple Music 3.4.0 for Android

About the security content of Apple Music 3.4.0 for Android This document describes the security content of Apple Music 3.4.0 for Android. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred an...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

git: Crafted URL containing new lines can cause credential leak

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality...