CVE-2019-6549

An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 through FTP...

PT-2019-11314 · Jenkins · Jenkins Job Import Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: A sensitive information exposure issue exists, allowing attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified...

CloudBees Jenkins Artifactory Plugin Disk Unencryption Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor ongoing software releases/testing projects and some timed tasks.Artifactory Plugin is a plugin that is used to release, parse and Publish traceable bui...

CloudBees Jenkins Mesos Plugin Access Privilege Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. It is mainly used to monitor continuous software release/testing projects and some timed tasks. Mesos Plugin is a plugin that can dynamically start Jenkins slave servers on a...

CloudBees Jenkins Mesos Plugin Improper Authorization Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.Mesos Plugin is used in one of the ability to dynamically start Jenkins slav...

CVE-2018-1000423

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2...

DEBIAN-CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file...

UBUNTU-CVE-2019-3500

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file...

PT-2018-3994

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.24.2 Description The issue is related to the use of open redirects in the Urllib3 HTTP library for Python. Exploitation of this issue can allow a remote attacker to access and compromise confidential data...

DEBIAN-CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

UBUNTU-CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

CVE-2018-20445

D-Link DCM-604 DCM604C1ViaCabo1.0420130606 and DCM-704 EUDCM-7041.10 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 and iso.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32 SNMP requests...

CVE-2018-20442

Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32 SNMP requests...

Zoom 5352 Information Disclosure Vulnerability

The Zoom 5352 is a modem device from Zoom Telephonics USA. An information disclosure vulnerability exists in the Zoom 5352 version 5.5.8.6Y, which can be exploited by a remote attacker to obtain credentials by sending an SNMP request...

CVE-2018-20401

Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-20386

ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-20401

Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

D-Link myDlink Baby App Information Disclosure Vulnerability

D-Link myDlink Baby App is an application from AUO D-Link for managing and controlling D-Link baby monitors. The information disclosure vulnerability in the D-Link myDlink Baby App version 2.04.06 arises from the fact that when an operation is performed using the app e.g., modifying the camera...

Credentials exposure in session storage

More info at https://simplesamlphp.org/security/201812-01...

The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.

The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...