OmniView Information Disclosure Vulnerability (CNVD-2016-13111)

OmniView is a data management control center for monitoring and controlling backup generators. An information disclosure vulnerability exists in OmniView.The OmniView web application uses the HTTP protocol to transmit credentials, which could be sniffed by an attacker, leading to the disclosure o...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

CVE-2016-6653

The MariaDB auditplugin component in Pivotal Cloud Foundry PCF cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials...

SQL Injection Vulnerability in Hangzhou Allview Software's Comprehensive Security Platform for Universities and Colleges

This comprehensive college security platform provides alarms and early warning announcements of hidden events, allowing security to be guaranteed under the supervision of the entire staff. The platform's database is not filtered for username and password parameters resulting in a SQL injection...

CVE-2016-3312: Exposure of Sensitive Information to an Unauthorized Actor

ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging failure of Universal Outlook to obtain a secure connection, aka "Universal Outlook Information Disclosure Vulnerability."...

The vulnerability of the Android operating system, which allows a hacker to gain access to user credentials

The vulnerability in the net/PacProxySelector.java script, related to Proxy Auto-Config PAC extensions on the Android operating system, stems from the lack of checks for restrictions related to URL information, host, and port. Exploiting this vulnerability allows a malicious actor to gain access ...

EMC RSA Archer eGRC Information Disclosure Vulnerability

EMC RSA Archer eGRC is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product can be used to manage enterprise risk, automate business processes, and more. A security vulnerability exists in the EMC RSA Archer eGRC 5.5.x release. A remote attacker can...

CVE-2016-0871: Exposure of Sensitive Information to an Unauthorized Actor

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

Zomato: NexTable: Credentials exposure

There was an issue with how the NexTable was storing passwords for merchants. This was fixed by the NexTable Team. Thanks @mrtuxracer for reporting this...

Cisco Hosted Collaboration Mediation Fulfillment Information Disclosure Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a set of software for centralized management of Cisco HCS solutions from Cisco USA. The software provides configuration, management and monitoring of Cisco HCM-F services and other functions. An information disclosure vulnerability exists ...

OpenNMS Default Password Vulnerability

OpenNMS is the U.S. OpenNMS company's set of enterprise-class, Java/XML-based distributed network and system monitoring and management platform, the platform can display the status and configuration of various terminals and servers in the network. OpenNMS has a default password vulnerability. All...

PT-2015-7061 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 8.0 update 3 Description: The issue allows local users to obtain sensitive information by reading log files with world-readable permissions, where local administrator credentials are stored. This i...

ceph-deploy admin command copies keyring file to /etc/ceph which is world readable

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...

ceph-deploy: keyring permissions are world readable in ~ceph

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file...

PT-2015-6092 · Unknown · Thermostat

Name of the Vulnerable Software and Affected Versions: Thermostat versions prior to 2.0.0 Description: The issue allows local users to obtain user credentials by reading the web.xml configuration file due to world-readable permissions. Recommendations: For versions prior to 2.0.0, update to versi...

docker: regression of CVE-2014-5277

It was found that the fix for the CVE-2014-5277 issue was incomplete: the docker client could under certain circumstances erroneously fall back to HTTP when an HTTPS connection to a registry failed. This could allow a man-in-the-middle attacker to obtain authentication and image data from traffic...

CVE-2015-0834: Exposure of Sensitive Information to an Unauthorized Actor

The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...