Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller and Storwize Family (CVE-2015-2613 CVE-2015-2601 CVE-2015-2625 CVE-2015-1931)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM SAN Volume Controller and Storwize Family. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An...

SUSE CVE-2015-1931

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by...

CVE-2022-38112 Sensitive Information Disclosure Vulnerability

In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext...

CVE-2022-38112

CVE-2022-38112 affects SolarWinds Database Performance Analyzer (DPA) versions 2022.4 and earlier. The underlying issue is that generated heap memory dumps disclose sensitive information in cleartext, impacting confidentiality (NVD/CVSS base 7.5 HIGH). The NCSC advisory notes fixes in DPA 2023.1;...

CVE-2022-38112 Sensitive Information Disclosure Vulnerability

In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext...

CVE-2015-1931

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by...

Design/Logic Flaw

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by...

CVE-2022-29620

FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a vulnerability...

FileZilla 安全漏洞

FileZilla is an open source FTP/SFTP client for Windows-based platforms. A security vulnerability exists in FileZilla version v3.59.0. An attacker exploits the vulnerability to obtain the plaintext password of a connected SSH or FTP server via a memory dump...

Rip Raw - Small Tool To Analyse The Memory Of Compromised Linux Systems

Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This is not a...

AVEVA System Platform 安全漏洞

AVEVA System Platform is an application from AVEVA UK. A responsive, standards-driven and scalable foundation for regulatory, enterprise SCADA, MES and IIoT applications. A security vulnerability exists in AVEVA System Platform, the successful exploitation of which could expose the plaintext...

Unspecified Vulnerability in Gallagher Command Center Server

Gallagher Command Center Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Center Server that stems from Gallagher Command Center Server allowing cloud end-to-end encryption keys to b...

CVE-2021-23211

Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable in server memory dumps. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3...

CVE-2021-23182

Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in server memory dumps. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; All versions of 8.30...

CVE-2021-23211

CVE-2021-23211 affects Gallagher Command Centre Server (Gallagher Command Centre 8.40 prior to 8.40.1888 MR3). The root cause is Cleartext Storage of Sensitive Information in Memory, allowing the Cloud end-to-end encryption key to be recoverable from server memory dumps. The connected PT-2021-154...

PT-2021-15406 · Gallagher · Gallagher Command Centre

Name of the Vulnerable Software and Affected Versions: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3 Description: The issue concerns a Cleartext Storage of Sensitive Information in Memory vulnerability in the Gallagher Command Centre Server. This vulnerability allows the Cloud...

Gallagher Command Centre Server 安全漏洞

Gallagher Command Center Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Center Server that stems from Gallagher Command Center Server allowing cloud end-to-end encryption keys to b...

PT-2021-15399 · Gallagher · Gallagher Command Centre Server

Name of the Vulnerable Software and Affected Versions: Gallagher Command Centre Server versions prior to 8.40.1888 MR3 Gallagher Command Centre Server version 8.30 Description: The issue is related to the cleartext storage of sensitive information in memory, specifically allowing OSDP reader mast...

PT-2021-19988 · Aveva · Aveva Intouch Runtime

Name of the Vulnerable Software and Affected Versions: AVEVA InTouch Runtime versions prior to 2020 R2 Description: The issue could expose cleartext credentials if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location...

CVE-2020-11252

Trustzone initialization code will disable xPUs when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...