133 matches found
GHSA-WWW2-V7XJ-XRC6 Exposure of Sensitive Information to an Unauthorized Actor in urllib3
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...
Elastic Cloud Enterprise (ECE) Information Disclosure Vulnerability
Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. An information disclosure vulnerability exists in Elastic Cloud Enterprise ECE, which can be exploited by an attacker to obtain...
Apache LDAP API Information Disclosure Vulnerability
Apache LDAP API is a U.S. Apache Apache Software Foundation API for accessing LDAP servers. A security vulnerability exists in Apache LDAP API versions prior to 1.0.2. An attacker can exploit the vulnerability to disclose information including: credentials contained in a request...
Design/Logic Flaw
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...
Genexis Automatic Provisioning System Access Control Vulnerability
The Genexis Automatic Provisioning System GAPS is a system for automatic configuration of routers and networks from the Dutch company GENEXIS. An access control vulnerability exists in GAPS 7.2 and earlier versions. An attacker can exploit this vulnerability to obtain configured setup information...
Design/Logic Flaw
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the...
Ayuda! (Help!) Equifax Has My Data!
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may n...
CVE-2017-4955
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to 1.9.5. Several credentials were present in the logs for the Notifications errand in the PCF Elastic Runtime tile...
New Relic: [docs-ra.newrelic.com] subdomain and Drupal takeover via unconfigured endpoint
Hi, While conducting New Relic web property reconnaissance, I came across the unused docs-ra.newrelic.com endpoint. This endpoint allowed an unauthenticated user to progress through the Drupal installation process and activate the site with their own configuration – it appears that valid MySQL...
SUSE-SU-2016:2217-1 Security update for kinit
kinit was updated to fix one security issue. This security issue was fixed: - CVE-2016-3100: World readable Xauthority file exposed cookie credentials boo983926...
Pablo Software Solutions FTP Service 1.2 Plaintext Password Weakness
No description provided by source. source: http://www.securityfocus.com/bid/7801/info It has been reported that Pablo FTP Service stores FTP User account passwords in plaintext format. As a result, these credentials could be exposed to other users. It should be noted that while this weakness has...
Amazon Web Services Combing Third Parties for Credentials
Amazon Web Services is actively searching a number of sources, including code repositories and application stores, looking for exposed credentials that could put users’ accounts and services at risk. A week ago, a security consultant in Australia said that as many as 10,000 secret Amazon Web...
