RHEL 7 : Red Hat Virtualization (RHSA-2019:2437)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2437 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

RHEL 7 : cockpit-ovirt (RHSA-2019:2433)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2433 advisory. Cockpit is a Linux system adminstration tool with a web UI, easy setup, and minimal system footprint at runtime. When installed on hosts in Red Hat...

Moderate: Red Hat Security Advisory: cockpit-ovirt security, bug fix, and enhancement update

An update for cockpit-ovirt is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment

A credential-protection flaw was found in cockpit-ovirt. During deployment, it generated an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contained both admin and appliance passwords as plain-text. Although these files are deleted at the end of th...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-10370

Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure...

CVE-2019-10370

Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure...

PT-2019-11766 · Jenkins · Jenkins Mask Passwords Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mask Passwords Plugin versions 2.12.0 and earlier Description: The issue allows globally configured passwords to be transmitted in plain text as part of the configuration form, potentially exposing them. Recommendations: For Jenkins...

Code injection

IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280...

CVE-2018-1987

IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280...

Security Bulletin: Password disclosure via application trace affects IBM Spectrum Protect for Enterprise Resource Planning (CVE-2018-1987)

Summary If tracing is activated, IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning may display the IBM Spectrum Protect node password in plain text in the trace file. Vulnerability Details CVEID: CVE-2018-1987 DESCRIPTION: IBM Tivoli Storage Manager for...

CVE-2019-3741

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s including the admin privilege user password is stored in a plain text in Unity Data Collection bundle logs files for troubleshooting. A local authenticated attacker...

Default credentials

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s including the admin privilege user password is stored in a plain text in Unity Data Collection bundle logs files for troubleshooting. A local authenticated attacker...

CVE-2019-3741

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s including the admin privilege user password is stored in a plain text in Unity Data Collection bundle logs files for troubleshooting. A local authenticated attacker...

CVE-2019-3741

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 store a password in plaintext inside the Unity Data Collection bundle (logs). A local authenticated attacker with access to this bundle can use the exposed password to gain access with the compromised user’s privileges. The documents do ...

CVE-2018-11421

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to...

CVE-2018-11421

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to...

Design/Logic Flaw

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to...

CVE-2018-11422

CVE-2018-11422 affects Moxa OnCell G3100-HSPA Series (versions 1.6 Build 17100315 and earlier). The vulnerability arises from a proprietary configuration protocol that provides no confidentiality, integrity, or authenticity—info is sent in plain text and can be intercepted or modified. Commands s...

CVE-2018-11422

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. Any commands including devi...