Information Disclosure

Undertow Core is vulnerable to information disclosure. Confidential information such as HTTP Authentication for HttpServerExchange object at ERROR level are logged in plain text using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange by Connectors.executeRootHandler:402...

EUVD-2017-6225

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

CVE-2019-7714

An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow...

Stack overflow

An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow...

CVE-2019-7714

An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow...

CVE-2019-7714: Out-of-bounds Write

An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copying this header to parse, it does not check the size of the header, leading to a stack-based buffer overflow...

Information Disclosure

yiisoft/yii2 is vulnerable to information disclosure. Confidential information such as HTTP authentication credentials containing username and password are logged in \yii\log\Target, which could allow an attacker to retrieve the information from log files and gain access to the application...

CVE-2016-4644

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials...

Authentication flaw

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials...

CVE-2016-4644

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials...

CVE-2016-4644

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials...

PT-2019-7828

Name of the Vulnerable Software and Affected Versions iOS versions prior to 9.3.3 tvOS versions prior to 9.2.2 OS X El Capitan versions prior to 10.11.6 and Security Update 2016-004 Description A downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was...

aria2 1.33.1 Password Disclosure

Exploit Title: Metadata and potential password leak in aria2 Date: 2019-01-02 Exploit Author: Dhiraj Mishra Software Link: https://github.com/aria2/aria2 Version: aria2 1.33.1 Tested on: Linux 4.15.0-38-generic CVE: CVE-2019-3500 Summary aria2 is a lightweight multi-protocol command-line utility,...

SUSE-SU-2018:4215-1 Security update for enigmail

This update for enigmail to version 2.0.9 fixes the following issues: Security issue fixed: - When using Web Key Discovery, a HTTP authentication may be triggered. This may trick users into possibly sending e-mail credentials bsc1118935. Non-security issues fixed: - pEp - PGP/MIME signed-only...

PT-2018-19239

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 2.0.9 Description A security issue is fixed where using Web Key Discovery may trigger an HTTP authentication, potentially tricking users into sending email credentials. Recommendations For Enigmail versions prior to...

CVE-2018-18353

Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page...

Scientific Linux Security Update : curl and nss-pem on SL7.x x86_64 (20181030)

Security Fixes : - curl: HTTP authentication leak in redirects CVE-2018-1000007 - curl: FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - curl: RTSP RTP buffer over-read CVE-2018-1000122 - curl: Out-of-bounds heap read when missing RTSP headers allows information leak of...

RHEL 7 : curl and nss-pem (RHSA-2018:3157)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3157 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...