Pentaminds CuroVMS 安全漏洞

Pentaminds CuroVMS is an intelligent visitor management system from Pentaminds. A security vulnerability exists in Pentaminds CuroVMS version v2.0.1 that stems from the inclusion of exposed credentials...

Pentaminds CuroVMS 安全漏洞

Pentaminds CuroVMS is an intelligent visitor management system from Pentaminds. A security vulnerability exists in Pentaminds CuroVMS version 2.0.1 that stems from the inclusion of exposed credentials...

PT-2024-28929

Name of the Vulnerable Software and Affected Versions Pentaminds CuroVMS version 2.0.1 Description The issue is related to exposed credentials in the software. This means that sensitive information, such as passwords or other authentication data, is not properly secured and can be accessed by...

CVE-2024-40583

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...

CVE-2024-48016

Dell Secure Connect Gateway SCG 5.0 Appliance - SRS, versions 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure. The attacker may be able to...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

Dell DM5500 安全漏洞

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. A security vulnerability exists in the Dell DM5500 version 5.16.0.0, which stems from the presence of an information disclosure vulnerabili...

CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

Dell NetWorker 安全漏洞

Dell NetWorker is an application from Dell USA Inc. Provides forum discussion features for Dell Inc. An information disclosure vulnerability exists in Dell NetWorker, which arises from the database storing plain text passwords in a temporary configuration file during backups, and can be exploited...

Dell DM5500 Information Disclosure Vulnerability

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. The Dell DM5500 suffers from an information disclosure vulnerability that originates from the inclusion of a plain text password in the PPO...

SUSE CVE-2018-25091

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this...

CVE-2022-42451

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user...

CVE-2023-22949

An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is logging of user credentials. All authenticated GSQL access requests are logged by TigerGraph in multiple places. Each request includes both the username and password of the user in an easily decodable base64 form. That...

SUSE CVE-2017-1000387

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

SUSE CVE-2018-1000143

An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials...

CVE-2022-32984

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the...

CVE-2021-36204

The CVE-2021-36204 vulnerability affects Johnson Controls Metasys ADS/ADX/OAS Servers: versions 10.x prior to 10.1.6 and 11.x prior to 11.0.3. Root cause is Insufficiently Protected Credentials, allowing API calls to expose plaintext credentials. Impact is high (confidentiality and total impact o...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Johnson Controls Equipment: Metasys ADS/ADX/OAS Servers Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could result in exposed credentials in plain text...