CVE-2018-1072

CVE-2018-1072 affects ovirt-engine prior to 4.2.2, where engine-backup logging could expose database credentials. The root cause is unfiltered passwords being written to provisioning logs when using --provision*db, leading to potential disclosure of usernames and passwords via shared logs. Public...

Red Hat ovirt-engine Information Disclosure Vulnerability

Red Hat oVirt is an open source virtualization management platform from Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side. overt-engine is one of the control center components, which is capable ...

CVE-2018-6619

CVE-2018-6619 affects Easy Hosting Control Panel (EHCP) v0.37.12.b. The vulnerability stems from the use of a weak hashing algorithm without a salt for database passwords (e.g., MD5), making it easier for attackers to crack passwords. Multiple connected sources corroborate insecure cryptography a...

Multiple Vulnerabilities in CoverCMS V1.16

CoverCMS is a content management system CMS. The system features multi-content distribution, scalability and multi-content type support. CoverCMS V1.16 suffers from reinstallation, information leakage, brute force, stored cross-site scripting and reflected cross-site scripting vulnerabilities...

GHSA-VQCM-7F7F-R539 brbackup exposes database password to unauthorized users

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...

brbackup exposes database password to unauthorized users

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...

NetApp OnCommand API Services and Service Level Manager Information Disclosure Vulnerability

NetApp OnCommand API Services and Service Level Manager are both products of the U.S. NetApp OnCommand API Services is a set of API management tools.Service Level Manager is service content management software. An information disclosure vulnerability exists in NetApp OnCommand API Services versio...

lynx doesn't properly sanitize user input and exposes database password to unauthorized users

The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes. As of version 1.0.0, lynx no longer supports a --password option. Passwords are only configured in a configuration file, so it's no...

GHSA-RHGQ-VV9X-J4P5 lawn-login exposes database password to unauthorized users

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...

lawn-login exposes database password to unauthorized users

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-5004

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...

Command injection

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-5004

The CVE-2014-5004 issue affects the brbackup Ruby gem (version 0.1.1) where lib/brbackup.rb places the database password on the mysql command line. This exposes the password to local users who can list the process, enabling plaintext disclosure of credentials and partial confidentiality impact. E...

EMC AppSync Server Hardcoded Password Vulnerability

EMC AppSync is a suite of data protection software from EMC Corporation. The software provides simple, self-service, service-level agreement SLA-driven data protection and storage management for EMC VNX and EMC VMAX storage.EMC AppSync Server is its server version. A hard-coded password...

EasyAdmin view method suffers from SQL injection vulnerability

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. EasyAdmin view method exists SQL injection vulnerability. Attackers can construct a specific URL injection to obtain the database password...

SQL Injection Vulnerability in EasyAdmin /application/index/controller/index.php Page

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. SQL injection vulnerability exists in the EasyAdmin /application/index/controller/index.php page. Attackers can construct a specific URL injection to obtain the...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

Default configuration

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...

CVE-2015-5959

CVE-2015-5959 affects Froxlor prior to 0.9.33.2, where default installations could disclose the database password by reading the /logs/sql-error.log file. Multiple sources (NVD entry and FreeBSD VuXML) describe an unauthenticated information-disclosure scenario tied to the /logs directory permiss...