PT-2019-11104 · Apc · Apc Ups Network Management Card 2

Name of the Vulnerable Software and Affected Versions: APC UPS Network Management Card 2 AOS version 6.5.6 Description: A Credentials Management issue exists, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled and then disabled...

Atlassian Confluence Server and Confluence Data Center File Disclosure Vulnerability

Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi.Confluence Data Center is the data center version of Confluence Center. A security vulnerability exists in...

CVE-2019-13348

CVE-2019-13348 affects Knowage up to 6.1.1: an authenticated user who visits the datasources page can access data source credentials in cleartext (including database credentials). Multiple connected sources corroborate this vulnerability (NVD entry, Red Hat advisory, CNVD, OSV, CVE listings). Roo...

CloudBees Jenkins JClouds Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . An authorization issue vulnerability exists in CloudBees Jenkins JClouds Plugin, which can be exploited by an attacker to gain access to credentials stored in...

PT-2019-11779 · Jenkins · Jenkins Eggplant Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins eggPlant Plugin version 2.2 and earlier Description: The issue allows credentials to be stored unencrypted in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission or those...

python-requests: Redirect from HTTPS to HTTP does not remove Authorization header

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...

CVE-2019-1020009

Fleet before 2.1.2 allows exposure of SMTP credentials...

CVE-2019-11273

Pivotal Container Services PKS versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information...

CVE-2019-13099

The Momo application 2.1.9 for Android stores confidential information insecurely on the system i.e., in cleartext, which allows a non-root user to find out the username/password of a valid user and a user's access token via Logcat...

Man-in-the-Middle (MitM)

Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Npm credentials such as authToken were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably...

DEBIAN-CVE-2019-13313

libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line...

PT-2019-13249 · Open Source +4 · Libosinfo +4

Name of the Vulnerable Software and Affected Versions: libosinfo version 1.5.0 Description: The issue allows local users to discover credentials by listing a process. This occurs because credentials are passed to osinfo-install-script via the command line. There is no information available about...

PT-2019-16915 · Ibm · Ibm Planning Analytics

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics version 2.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

UBUNTU-CVE-2016-7404

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform...

CVE-2019-6972

An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the...

CVE-2019-4381

IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API to interface with the HMC. An attacker could exploit this vulnerability to obtain HMC credentials. IBM X-Force ID: 162159...

PT-2019-17049 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i version 7.27.3 Description: The issue allows a local attacker to obtain sensitive information by exploiting the use of advanced node failure detection using the REST API to interface with the HMC. This could potentially allow an attacke...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

PT-2019-11722 · Jenkins · Jenkins Artifactory Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.2.2 and earlier Description: A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturin...

PT-2019-11723 · Jenkins · Jenkins Artifactory Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.2.2 and earlier Description: A missing permission check in the Jenkins Artifactory Plugin allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credential...