Default credentials

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in multiple log files. A local authenticated attacker with access to the l...

CVE-2020-29501

Dell EMC PowerStore (X & T) versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage vulnerability enabling a locally authenticated attacker to disclose certain user credentials. The issue arises from how passwords are stored, allowing exposure of credentials that could be used to ac...

CVE-2020-29502

Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able ...

CVE-2020-29502

Dell EMC PowerStore (X & T) versions prior to 1.0.3.0.5.007 are affected by a Plain-Text Password Storage vulnerability. A locally authenticated attacker could potentially disclose user credentials stored in plain text, enabling access to the vulnerable application with privileges of the compromi...

CVE-2020-29500

Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to u...

CVE-2020-29500

Dell EMC PowerStore (PowerStore T) versions prior to 1.0.3.0.5.007 are affected by a Plain-Text Password Storage vulnerability. The root cause is storing passwords in plaintext, enabling a locally authenticated attacker to disclose certain user credentials and then potentially access the vulnerab...

CVE-2020-29489

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in a system file. A local authenticated attacker with access to the syste...

CVE-2020-29489

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plaintext password storage vulnerability. A local authenticated attacker with access to system files can read a password file and use exposed credentials (including the Unisphere admin user) to gain access with the c...

CVE-2020-26199

Dell EMC Unity, Unity XT, and UnityVSA contain a plain-text password storage vulnerability in versions prior to 5.0.4.0.5.012. A local authenticated attacker with access to the log files can extract user credentials (including the Unisphere admin) and gain access with the compromised user’s privi...

CVE-2020-26199

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in multiple log files. A local authenticated attacker with access to the l...

PT-2021-4077 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.6 and later Description: The issue is related to the exposure of pull mirror credentials in GitLab, allowing other maintainers to view the credentials in plain-text. This could potentially enable a remote attacker to gain...

CVE-2020-4899

IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive information across the network. IBM X-Force ID: 190990...

[ASA-202101-2] roundcubemail: cross-site scripting

Arch Linux Security Advisory ASA-202101-2 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35730 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1388 Summary ======= The package roundcubemail...

Updated roundcubemail package fixes security vulnerability

Fixes stored cross-site scripting XSS vulnerability via HTML or plain text messages with malicious content. CVE-2020-35730...

DEBIAN-CVE-2020-35730

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...

Cross site scripting

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...

[SECURITY] [DLA 2508-1] roundcube security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2508-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 28, 2020 https://wiki.debian.org/LTS -...

PYSEC-2020-262

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field...

PT-2020-15028 · Apache · Airflow

Name of the Vulnerable Software and Affected Versions: Airflow versions prior to 1.10.13 Description: The issue occurs when creating a user using the airflow CLI or when creating a Connection with a password field in Airflow, where the password gets logged in plain text in the Log table in Airflo...

ownCloud: Protocol Smuggling over LDAP password field

Privileges required: Admin Hi, "userldap" plugin can be leveraged to interact with internal services over various protocols. LDAP password field can be exploited with newline chars \r\n in order to communicate with protocols like SMTP, Redis and, generally speaking, with all services those speak...