CVE-2019-3891

It was discovered that a world-readable log file, belonging to the Candlepin component of Red Hat Satellite 6.4, leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from...

PT-2019-16756

Name of the Vulnerable Software and Affected Versions Red Hat Satellite version 6.4 Description A security issue was found in the Candlepin component of Red Hat Satellite, where a world-readable log file leaked the credentials of the Candlepin database. This could allow a malicious user with loca...

CVE-2019-3891: Insertion of Sensitive Information into Log File

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...

CVE-2019-0285

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio fixed in version 2010 discloses sensitive database information including credentials which can be misused by the attacker...

CVE-2019-0285

SAP Crystal Reports for Visual Studio contains a vulnerability in the .NET SDK WebForm Viewer where the viewer discloses sensitive database information, including credentials. The issue affects the WebForm Viewer component used by the SAP Crystal Reports for Visual Studio environment and is descr...

PT-2019-2584

Name of the Vulnerable Software and Affected Versions SAP Crystal Reports for Visual Studio versions prior to 2010 Description The issue is related to the disclosure of sensitive database information, including credentials, due to a lack of protection for service data. This can be exploited by an...

IDenticard PremiSys Default Database Credentials (CVE-2019-3909)

Default database username and password exist in the IDenticard PremiSys database . The vulnerability is due to users are unable to change these passwords without vendor intervention. A remote attacker can exploit this vulnerability to access the database with administrator privileges...

PT-2018-15400

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.0.0 through 3.0.34 Description The issue allows remote authenticated administrators to read sensitive information via server-side template injection. This can be demonstrated by a % string for craft.app.config.DB.user and...

ThinkSNS V4.6 Session suffers from information leakage vulnerability

ThinkSNS is an open source social system under Wise Software Beijing Co. ThinkSNS V4.6 Session suffers from an information disclosure vulnerability. Attackers can use this vulnerability to obtain sensitive information such as database username and password...

Design/Logic Flaw

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

CVE-2018-11079

CVE-2018-11079 affects Dell EMC Secure Remote Services (ESRS) prior to 3.32.00.08. The vulnerability is plaintext storage of database credentials in a configuration file, allowing an authenticated user with access to that file to obtain the password and gain access to the application database. Se...

CVE-2018-11079: Insufficiently Protected Credentials

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

Dell EMC ESRS Virtual Edition Plaintext Password Storage Vulnerability

Dell EMC ESRS is a secure storage product from DEll. A plaintext password storage vulnerability exists in Dell EMC ESRS Virtual Edition that originates when database credentials are stored in plaintext in a configuration file. An authenticated, malicious user with access to the configuration file...

Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

Joomanager Component Information Disclosure Vulnerabilities

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other features . Joomanager is used in one of the site advertising module . An information disclosure vulnerability exists in the Joomanager...

CVE-2017-18345

The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...

CVE-2017-18345

The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...

PT-2018-6842

Name of the Vulnerable Software and Affected Versions: Joomanager component for Joomla! versions through 2.0.0 Description: The issue allows for arbitrary file download, which can expose database credentials. This can be achieved through a request to "index.php?option=com...

CVE-2017-18345: Exposure of Sensitive Information to an Unauthorized Actor

The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...