CVE-2017-15656

CVE-2017-15656 is confirmed to affect AsusWRT firmware with the httpd nvram storage path. Multiple connected sources state plaintext passwords are stored in nvram and thus readable without proper protection in versions up to 3.0.0.4.380.7743 (and earlier per CNVD), enabling an attacker with acces...

CVE-2017-1000387

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

Debian DSA-4070-1 : enigmail - security update

Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked signatures, plain text leaks and denial of service. Additional information can be found under...

[SECURITY] [DLA 1219-1] enigmail security update

Package : enigmail Version : 2:1.9.9-1deb7u1 CVE ID : CVE-2017-17843 CVE-2017-17844 CVE-2017-17845 CVE-2017-17846 CVE-2017-17847 CVE-2017-17848 Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked...

LocalTapiola: Cleartext protocol after bank authentication (yrityspalvelu.tapiola.fi)

Issue The reporter found a redirect from https-http-https in the late stages of the authentication process. Fix The issue was fixed. Reasoning Although no authentication information was leaked, session related data could in theory also leak at this stage of the authentication process, hence a...

[SECURITY] [DSA 4070-1] enigmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4070-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 21, 2017 https://www.debian.org/security/faq -...

CVE-2017-1694

IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-Force ID: 134165...

CVE-2017-1694

IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-Force ID: 134165...

CVE-2017-1694

IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-Force ID: 134165...

Debian: Security Advisory (DSA-4070-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file...

CVE-2017-15104

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file...

CVE-2017-15104

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file...

Important: Red Hat Security Advisory: heketi security update

An update for heketi is now available for Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

heketi: Information disclosure through world readable file

An access flaw was found in heketi, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file...

CVE-2017-15104

An access flaw was found in heketi, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file...

PT-2017-13872 · Red Hat · Heketi

Name of the Vulnerable Software and Affected Versions: Heketi version 5 Description: A security issue was discovered where the heketi.json configuration file is world readable, allowing an attacker with local access to the Heketi server to read plain-text passwords from the file. This issue expos...

golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting

It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application...

OpenJDK: use of unprotected sname in Kerberos client (Libraries, 8178794)

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java...

Collection of 1.4 Billion Plain-Text Leaked Passwords Found Circulating Online

Hackers always first go for the weakest link to quickly gain access to your online accounts. Online users habit of reusing the same password across multiple services gives hackers opportunity to use the credentials gathered from a data breach to break into their other online accounts. Researchers...