PT-2024-36345 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions 13.7.1 through 15.1 Description: This issue was addressed with additional entitlement checks. A malicious application may be able to leak a user's credentials. Recommendations: Update to macOS version 13.7.1. Update to macOS...

CVE-2024-47197 Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...

CVE-2024-41674 CKAN may leak Solr credentials via error message in package_search action

CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL potentially including credentials could be leaked to packagesearch calls as part of the returned error message. This has been patched ...

CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-28849)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28849 advisory. - follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically...

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

...

UBUNTU-CVE-2024-6104

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

GHSA-C25H-C27Q-5QPV Keycloak leaks configured LDAP bind credentials through the Keycloak admin console

Impact The LDAP testing endpoint allows to change the Connection URL independently of and without having to re-enter the currently configured LDAP bind credentials. An attacker with admin access permission manage-realm can change the LDAP host URL "Connection URL" to a machine they control. The...

GHSA-99PG-GRM5-QQ3V Docker CLI leaks private registry credentials to registry-1.docker.io

Impact A bug was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json listing a credsStore or credHelpers that could not be executed would result in any provided credentials being sent to...

CVE-2024-37150

CVE-2024-37150 affects Deno 1.44.0, where Deno would send .npmrc credentials for a scope to tarball URLs when the registry serves tarballs from a different domain. This could expose private registry credentials if tarball URLs point offsite. The issue impacts users relying on .npmrc in scenarios ...

GO-2024-2789 Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator

Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator...

Fedora 40 : pgadmin4 (2024-db558f6fb2)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-db558f6fb2 advisory. Fix CVE-2024-28849. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for thi...

GHSA-X5M7-63C6-FX79 Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak

Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not affect a package in the Go registry. For more information, see the discussion here. This link is maintained to preserve external references. Original Description A credentials leak vulnerability was found in th...

Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak

Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not affect a package in the Go registry. For more information, see the discussion here. This link is maintained to preserve external references. Original Description A credentials leak vulnerability was found in th...

CVE-2024-1139

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

CVE-2024-1139

CVE-2024-1139 affects OpenShift Container Platform’s cluster-monitoring-operator. The root cause is a credentials leak where a repository pull secret can be accessed via pod manifest annotations (notably within the telemeter-client pod in openshift-monitoring). This could allow a user with basic ...

CVE-2024-1139 Cluster-monitoring-operator: credentials leak

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

CVE-2024-1139 Cluster-monitoring-operator: credentials leak

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

CVE-2024-1139

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret...

PT-2024-11747 · Siklu · Siklu Tg Terragraph

Name of the Vulnerable Software and Affected Versions: Siklu TG Terragraph devices versions prior to 2.1.1 Description: The issue allows attackers to discover valid, randomly generated credentials via the GetCredentials endpoint. This can potentially lead to unauthorized access. Recommendations:...