OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OmniView Information Disclosure Vulnerability (CNVD-2016-13111)

OmniView is a data management control center for monitoring and controlling backup generators. An information disclosure vulnerability exists in OmniView.The OmniView web application uses the HTTP protocol to transmit credentials, which could be sniffed by an attacker, leading to the disclosure o...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

CVE-2016-6653

The MariaDB auditplugin component in Pivotal Cloud Foundry PCF cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials...

SQL Injection Vulnerability in Hangzhou Allview Software's Comprehensive Security Platform for Universities and Colleges

This comprehensive college security platform provides alarms and early warning announcements of hidden events, allowing security to be guaranteed under the supervision of the entire staff. The platform's database is not filtered for username and password parameters resulting in a SQL injection...

The vulnerability of the Android operating system, which allows a hacker to gain access to user credentials

The vulnerability in the net/PacProxySelector.java script, related to Proxy Auto-Config PAC extensions on the Android operating system, stems from the lack of checks for restrictions related to URL information, host, and port. Exploiting this vulnerability allows a malicious actor to gain access ...

EMC RSA Archer eGRC Information Disclosure Vulnerability

EMC RSA Archer eGRC is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product can be used to manage enterprise risk, automate business processes, and more. A security vulnerability exists in the EMC RSA Archer eGRC 5.5.x release. A remote attacker can...

Zomato: NexTable: Credentials exposure

There was an issue with how the NexTable was storing passwords for merchants. This was fixed by the NexTable Team. Thanks @mrtuxracer for reporting this...

Cisco Hosted Collaboration Mediation Fulfillment Information Disclosure Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a set of software for centralized management of Cisco HCS solutions from Cisco USA. The software provides configuration, management and monitoring of Cisco HCM-F services and other functions. An information disclosure vulnerability exists ...

OpenNMS Default Password Vulnerability

OpenNMS is the U.S. OpenNMS company's set of enterprise-class, Java/XML-based distributed network and system monitoring and management platform, the platform can display the status and configuration of various terminals and servers in the network. OpenNMS has a default password vulnerability. All...

PT-2015-7061 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 8.0 update 3 Description: The issue allows local users to obtain sensitive information by reading log files with world-readable permissions, where local administrator credentials are stored. This i...

ceph-deploy: keyring permissions are world readable in ~ceph

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...

ceph-deploy admin command copies keyring file to /etc/ceph which is world readable

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...

PT-2015-6092 · Unknown · Thermostat

Name of the Vulnerable Software and Affected Versions: Thermostat versions prior to 2.0.0 Description: The issue allows local users to obtain user credentials by reading the web.xml configuration file due to world-readable permissions. Recommendations: For versions prior to 2.0.0, update to versi...

docker: regression of CVE-2014-5277

It was found that the fix for the CVE-2014-5277 issue was incomplete: the docker client could under certain circumstances erroneously fall back to HTTP when an HTTPS connection to a registry failed. This could allow a man-in-the-middle attacker to obtain authentication and image data from traffic...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

CVE-2014-6075

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-serv...

RHEL 6 : JBoss EWP (RHSA-2013:0195)

Updated JBoss Enterprise Web Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...