Mageia: Security Advisory (MGASA-2015-0108)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GNU Recutils Resource Management Error Vulnerability

GNU Recutils is a GNU community tool and library for accessing recfiles plain text databases. GNU Recutils has security vulnerabilities that can be exploited by attackers to cause segmentation errors or application crashes...

GHSA-GG9M-X3CG-69VH Access key stored in plain text by Jenkins Metrics Plugin

Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file jenkins.metrics.api.MetricsAccessKey.xml on the Jenkins controller as part of its configuration. This access key can be viewed by users with access to the Jenkins controller file system...

Access key stored in plain text by Jenkins Metrics Plugin

Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file jenkins.metrics.api.MetricsAccessKey.xml on the Jenkins controller as part of its configuration. This access key can be viewed by users with access to the Jenkins controller file system...

GHSA-C8CC-HJ57-VM65 User passwords transmitted in plain text by Jenkins Active Directory Plugin

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

Password stored in plain text by Jenkins Publish Over SSH Plugin

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

GHSA-R3RR-WPH6-9638 Password stored in plain text by Jenkins Publish Over SSH Plugin

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

Backdoor.Win32.Visiotrol.10 Insecure Password Storage

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/f9dc0a462ada737f36efafac56f22b97.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Visiotrol.10 Vulnerability: Insecure Password Storage Description: The malware listen...

CVE-2021-36318

Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage...

CVE-2021-36317

Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the...

CVE-2021-36318

Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage...

Denial of service

Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage...

CVE-2021-36318

Dell EMC Avamar vulnerable versions 18.2, 19.1, 19.2, 19.3, 19.4 contain a plain-text password storage vulnerability affecting AvInstaller for 19.4 and other releases. A high-privileged user could exploit this to disclose credentials and potentially cause a complete outage of the affected system....

CVE-2021-36317

Dell EMC Avamar Server 19.4 is listed as affected by CVE-2021-36317 due to a plain-text password storage vulnerability in AvInstaller. The vulnerability could allow a local attacker to disclose user credentials and then access the vulnerable application with the compromised account’s privileges. ...

postgresql: server processes unencrypted bytes from man-in-the-middle

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...

PT-2021-21220 · Dell Emc · Dell Emc Avamar

Name of the Vulnerable Software and Affected Versions: Dell EMC Avamar versions 18.2, 19.1, 19.2, 19.3, 19.4 Description: The issue is related to plain-text password storage. A high privileged user could potentially exploit this, leading to a complete outage. Recommendations: For versions 18.2,...

WBCE CMS 1.5.1 Admin Password Reset

Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset Google Dork: intext: "Way Better Content Editing" Date: 20/12/2021 Exploit Author: citril or https://github.com/maxway2021 Vendor Homepage: https://wbce.org/ Software Link: https://wbce.org/de/downloads/ Version: = 1.5.1 Tested on: Linux CVE :...

The vulnerability of the FortiSIEM Windows Agent security management system lies in the fact that user credentials are stored as plain-text files in log files. This allows attackers to gain unauthorized access to the protected information.

The vulnerability of the FortiSIEM Windows Agent security management system lies in the fact that account data is stored as plain-text files in log files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Scientific Linux Security Update : samba on SL7.x i686/x86_64 (2021:5192)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:5192-1 advisory. - samba: Active Directory AD domain user could become root on domain members CVE-2020-25717 - samba: SMB1 client connections can be downgraded to...

postgresql: server processes unencrypted bytes from man-in-the-middle

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...