golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting

It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application...

OpenJDK: use of unprotected sname in Kerberos client (Libraries, 8178794)

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java...

Collection of 1.4 Billion Plain-Text Leaked Passwords Found Circulating Online

Hackers always first go for the weakest link to quickly gain access to your online accounts. Online users habit of reusing the same password across multiple services gives hackers opportunity to use the credentials gathered from a data breach to break into their other online accounts. Researchers...

Authentication flaw

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials...

CVE-2016-6904

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials...

CVE-2016-6904

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials...

CVE-2016-6904

CVE-2016-6904 affects NetApp VASA Provider for Clustered Data ONTAP prior to 7.0P1. A web server accepts plain text authentication, enabling an unauthenticated attacker to obtain authentication credentials. Impact: credential disclosure and potential access to protected data/interfaces. Exploitat...

CVE-2016-6904

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials...

IBM WebSphere MQ < Information Disclosure Vulnerability (swg22003853)

IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free Vulnerability

Exploit for windows platform in category dos / poc Multiple Vulnerabilities in PSFTPd Windows FTP Server ===================================================== Overview -------- Confirmed Affected Versions: 10.0.4 Build 729 Confirmed Patched Versions: None Vendor: Sergei Pleis Softwareentwicklung...

PSFTPd Windows FTP Server 10.0.4 Build 729 Use-After-Free / Log Injection

X41 D-Sec GmbH Security Advisory: X41-2017-006 Multiple Vulnerabilities in PSFTPd Windows FTP Server ===================================================== Overview -------- Confirmed Affected Versions: 10.0.4 Build 729 Confirmed Patched Versions: None Vendor: Sergei Pleis Softwareentwicklung Vend...

CVE-2017-1000171

Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...

CVE-2017-1000157

Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the eventlog table during the user creation process if full event logging was turned on...

CVE-2017-1000157

Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the eventlog table during the user creation process if full event logging was turned on...

Code injection

Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the eventlog table during the user creation process if full event logging was turned on...

Code injection

Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...

CVE-2017-1000171

CVE-2017-1000171 affects Mahara Mobile prior to version 1.2.1, where passwords are logged in plaintext to the Mahara access log. The issue stems from logging sensitive credentials, enabling potential exposure of passwords via log access. Impact is information disclosure of login credentials via l...

CVE-2017-1000157

Summary: Mahara is affected by a vulnerability where passwords could be recorded in plaintext in the event_log table during user creation if full event logging is enabled. Affected versions: 15.04 prior to 15.04.13, 16.04 prior to 16.04.7, 16.10 prior to 16.10.4, and 17.04 prior to 17.04.2. Root ...

CVE-2017-15918

Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks...

Privilege escalation

Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks...