User-scoped credentials exposed to other users by blueocean-pipeline-scm-api

When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provid...

CVE-2022-26308

Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration Credential store where a user with the role of Operator Write could create, delete, view existing keys which are outside the intended role...

encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-0430 via httpie (1.0.3)

httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-0430 Source advisory:...

encapsia-cli (>=0.1.8, <=0.2.1), httpie-credential-store (1.0.0) +1 more potentially affected by CVE-2022-24737 via httpie (1.0.3)

httpie PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on httpie and may be impacted: - encapsia-cli =0.1.8, =0.2.1 - httpie-credential-store 1.0.0 - veracode-api-signing 21.3.0 Source cves: CVE-2022-24737 Source advisory:...

Improper Access Control in Configuration (Credential store)

Description Pandora FMS v7.0NG.759 allows improper access control in Configuration Credential store where a user with the role of Operator Write could create, delete, view existing keys which are outside the intended role. Proof of Concept Affected endpoint: POST...

Ubuntu: Security Advisory (USN-5134-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5134-1 docker.io vulnerability

An information disclosure issue was discovered in the command line interface of Docker. A misconfigured credential store could result in supplied credentials being leaked to the public registry, when using the docker login command with a private registry...

DEBIAN-CVE-2021-41092

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json listing a credsStore or credHelpers that could not be...

VulnCheck KEV: CVE-2017-15718

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

Exposure of Sensitive Information in Hadoop

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

GHSA-MQ8P-H798-XCRP Exposure of Sensitive Information in Hadoop

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...

CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

Code injection

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

CVE-2018-9065

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and...

CVE-2018-9065

Lenovo xClarity Administrator (LXCA) versions prior to 2.1.0 expose a credential store containing service processor usernames/passwords for servers previously managed by the LXCA instance. If an attacker with access to the LXCA filesystem user can read this store, they may decrypt credentials mor...

PT-2018-18826

Name of the Vulnerable Software and Affected Versions Lenovo xClarity Administrator versions prior to 2.1.0 Description The issue allows an attacker with access to the underlying LXCA file system user to potentially retrieve a credential store. This store contains service processor user names and...

CVE-2018-8042

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie...

CVE-2018-8042

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie...

CVE-2018-8042

Affected software/versions: Apache Ambari 2.5.0–2.6.2. Vulnerability: passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services (e.g., Hive, Oozie). This constitutes an information disclosure vu...