IBM Cloud Pak for Security Cross-Site Scripting Vulnerability (CNVD-2021-34348)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A cross-site scripting vulnerability exists in IBM Cloud Pak for Security versions...

IBM Cloud Pak for Security 跨站脚本漏洞

IBM Cloud Pak for Security is an application from IBM America, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. IBM Cloud Pak for Security suffers from a cross-site scripting vulnerability that...

IBM Control Desk 跨站脚本漏洞

IBM Control Desk is an application from IBM USA. Automated service management and seamlessly integrated, best-practice based service desk functionality. IBM Smart Cloud Control Desk suffers from a cross-site scripting vulnerability that originates from allowing a user to embed arbitrary JavaScrip...

Code injection

An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,...

CVE-2021-22206

CVE-2021-22206 (GitLab) affects GitLab CE/EE versions starting from 11.6 where pull mirror credentials could be exposed and viewed in plain text by other maintainers. The issue’s impact includes potential access to sensitive credentials and related abuse. Public advisories indicate fixes in GitLa...

IBM QRadar SIEM 跨站脚本漏洞

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A cross-site...

CloudBees Jenkins Config File Provider Plugin Privilege Check Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software release/testing projects and some of the timed execution of the task.Config File Provider Plugin is...

CVE-2021-22115

Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller...

CVE-2021-22876

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header...

CVE-2021-20352

IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194710...

PT-2021-14675 · Jenkins · Jenkins Owasp Dependency-Track Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OWASP Dependency-Track Plugin versions 3.1.0 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in...

CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

CVE-2021-21361

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Impact The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. Patch...

Gradle 日志信息泄露漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A log message disclosure vulnerability exists in the Gradle plugin's com.bmuschko:gradle-vagrant-plugin. When this Gradle plugin is executed in a public CI/CD, it results in the...

CVE-2020-4975

IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435...

PT-2021-14570 · Dell Emc · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell EMC OpenManage Server Administrator OMSA versions 9.5 and prior Description: The issue allows a remote user with admin privileges to potentially view arbitrary files on the target system by sending a specially crafted URL request. This c...

IBM Engineering Test Management 跨站脚本漏洞

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management with broad coverage from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management. An attacker could explo...

ansible: multiple modules expose secured values

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by nolog feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to dat...

module: bitbucket_pipeline_variable exposes secured values

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...