The vulnerability of the AssumeRoleWithWebIdentity request of the Security Token Service (AWS STS) – a single API for interacting with object storage services and local files in Apache Arrow Rust Object Store – allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the AssumeRoleWithWebIdentity request of the Security Token Service AWS STS – a single API for interacting with object storage services and local files – is related to insufficient protection of registration data. Exploiting this vulnerability allows an attacker to bypass...

Enjay CRM 安全漏洞

Enjay CRM is a customer relationship management software from Enjay India. A security vulnerability exists in Enjay CRM versions prior to 19.6 that stems from the presence of a sensitive information vulnerability that allows logged in users to retrieve information about IP infrastructure and...

PT-2024-27324 · Dell · Dell Data Manager Appliance

Name of the Vulnerable Software and Affected Versions: Dell Data Manager Appliance Software version 5.16.0.0 Description: The issue is related to an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this, leading to the disclosure of certain use...

CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity. This allows someone with access to the logs t...

Credentials Exposure

Zowe CLI is vulnerable to a credentials exposure. The vulnerability is due to insecure storage of credentials in the Zowe CLI's auto-init operation, allowing attackers to access and potentially misuse sensitive information stored in a plaintext file...

PT-2024-22741 · Unknown · Streampark

Name of the Vulnerable Software and Affected Versions: Streampark versions prior to 2.1.4 Description: The issue allows a user to obtain sensitive information, including usernames, passwords, and salt values of other users, after a successful login. This is due to the Backend service returning...

The vulnerability of the web interface of the IBM InfoSphere Information Server software platform allows a perpetrator to disclose account information during a secure session.

The vulnerability in the web interface of the IBM InfoSphere Information Server software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to disclose credentials during a secure sessio...

PT-2024-5382 · Apache · Apache Arrow Rust Object Store

Name of the Vulnerable Software and Affected Versions: Apache Arrow Rust Object Store versions 0.10.1 and earlier Description: The issue is related to the exposure of temporary credentials in logs when using AWS WebIdentityTokens with the object store crate. On certain error conditions, the logs...

Siemens SIMATIC WinCC和Siemens SIMATIC PCS 安全漏洞

Siemens SIMATIC PCS 7 is a process control system from Siemens, Germany.SIMATIC WinCC is an automated data acquisition and monitoring SCADA system.SIMATIC WinCC Runtime Professional is a runtime platform for operator visualization, machine and device control and monitoring. equipment control and...

PT-2024-36780 · Longse · Lbh30Fe200W +1

Name of the Vulnerable Software and Affected Versions: Longse NVR Network Video Recorder model NVR3608PGE2W Longse model LBH30FE200W cameras Description: The issue concerns the transmission of user login and password to a remote control service without encryption, allowing an on-path attacker to...

MSP360 Security Breach

MSP360 is a cost-effective, flexible and versatile backup and data recovery solution from MSP360, Inc. A security vulnerability exists in MSP360 7.8.5.15 and 7.9.4.84, which stems from the use of hard-coded key encryption and allows an attacker to obtain network share credentials used in backups...

CVE-2024-39459

In rare cases Jenkins Plain Credentials Plugin 182.v468b97b9dcb8 and earlier stores secret file credentials unencrypted only Base64 encoded on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system global credentials or with...

Magarsus Consultancy SSO SQL Injection Vulnerability

Magarsus Consultancy SSO is a single sign-on application from Magarsus Consultancy. A SQL injection vulnerability exists in Magarsus Consultancy SSO Single Sign On versions 1.0 through 1.1, which arises from an improper neutralization of special elements used in SQL commands, insufficient...

PT-2024-9955 · Rockwell Automation · Rockwell Automation Factorytalk System Service

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk System Service affected versions not specified Description: The issue is related to the exposure of sensitive information due to the lack of explicit permissions set on the backup folder. A malicious user could...

AZL-42877 CVE-2024-6104 affecting package skopeo for versions less than 1.14.4-2

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

HashiCorp go-retryablehttp Log Information Disclosure Vulnerability

go-retryablehttp is a retryable HTTP client in Go open-sourced by HashiCorp. A security vulnerability exists in Hashicorp go-retryablehttp versions prior to 0.7.7, which stems from failure to clean up a URL when writing it to a log file, resulting in sensitive HTTP basic authentication credential...

CVE-2024-27170

It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the reference URL...

PT-2024-21704 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: It was observed that all the Toshiba printers contain credentials used for WebDAV access in a readable file, allowing for full access with WebDAV to the printer. Recommendations: A...

CVE-2024-5947

Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to...