CVE-2022-26307 Weak Master Keys

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...

CVE-2022-26307

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 t...

CVE-2022-32294

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password from the "zmprove ca" command. It is visible in cleartext on port UDP 514 aka the syslog port. NOTE: a third party reports that this cannot be reproduced...

CVE-2022-32294

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password from the "zmprove ca" command. It is visible in cleartext on port UDP 514 aka the syslog port. NOTE: a third party reports that this cannot be reproduced...

CVE-2022-32294

The connected sources confirm a vulnerability in Zimbra Collaboration Open Source 8.8.15 where the initial-login randomly created password (generated by the zmprove ca command) is not encrypted and is visible in cleartext on UDP port 514 (syslog). Root cause described as lack of encryption for th...

CVE-2022-32294

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password from the "zmprove ca" command. It is visible in cleartext on port UDP 514 aka the syslog port. NOTE: a third party reports that this cannot be reproduced...

Passwords stored in plain text by Jenkins Artifactory Plugin

Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml. This password can be viewed by users with access to the Jenkins controller file system. Artifactory Plugin 3.6.0 now stores the...

GHSA-PXV2-MFQ7-VHP6 Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions,...

Dolibarr Cross Site Request Forgery (CSRF)

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery CSRF. The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access...

GHSA-HWMC-V6J6-GC2P Dolibarr Cross Site Request Forgery (CSRF)

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery CSRF. The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access...

Jenkins Perforce Plugin exposure of sensitive information vulnerability exists

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them...

VICIdial Multiple Authenticated SQLi

This module exploits several authenticated SQL Inject vulnerabilities in VICIdial 2.14b0.5 prior to svn/trunk revision 3555 VICIBox 10.0.0, prior to January 20 is vulnerable. Injection point 1 is on vicidial/admin.php when adding a user, in the modifyemailaccounts parameter. Injection point 2 is ...

Mitsubishi MELSEC Q03UDECPU PLC has a Logic Defect Vulnerability

Mitsubishi Electric Automation China Co., Ltd. is a wholly-owned enterprise in China invested by Mitsubishi Electric Corporation. It mainly produces mechanical appliances for power distribution including low-voltage circuit breakers, electromagnetic openers and closers, electrical processing...

CVE-2020-25180

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm...

CVE-2022-25012

Argus Surveillance DVR v4.0 employs weak password encryption...

CVE-2022-25012

Argus Surveillance DVR v4.0 employs weak password encryption...

CVE-2022-25012

Argus Surveillance DVR v4.0 is affected by a weakness in its password handling: the use of weak password encryption. The disorder originates in the authentication mechanism and is documented across multiple feeds in the CVE-2022-25012 family. Public references in connected sources include exploit...

Argus Surveillance Dvr 加密问题漏洞

Argus Surveillance Dvr is a general purpose software for secure hybrid platforms from Argus Surveillance USA. It works simultaneously with wireless and wired Ip cameras, TV boards, capture cards, powerline and Usb cameras. A security vulnerability exists in Argus Surveillance DVR version v4.0 tha...

CVE-2021-45458

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...

Cross site request forgery (csrf)

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...