undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2020-2165

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2165

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

Code injection

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2165

The CVE-2020-2165 issue affects the Jenkins Artifactory Plugin and is caused by transmitting passwords in plain text through the global Jenkins configuration form for versions 3.6.0 and earlier, potentially exposing credentials (e.g., via browser extensions or related vectors). The problem is spe...

PT-2020-2653 · Jenkins · Jenkins Artifactory Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Artifactory Plugin versions 3.6.0 and earlier Description: The issue is related to the transmission of configured passwords in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. This...

Security Bulletin: IBM Integration Bus is affected by Web UI security vulnerability (CVE-2017-1694)

Summary IBM Integration Bus has addressed the following vulnerability Vulnerability Details CVEID: CVE-2017-1694 DESCRIPTION: IBM Integration Bus transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. CVSS Base Score: 5.9 CVSS Tempor...

CVE-2020-5262

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

Siemens SiNVR 3 Plain Text Save File Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 stores login credentials in plain text in a log file. An information disclosure vulnerability exists in the implementation, which can be exploited by a...

The vulnerability of the web interface of Belden Hirschmann’s network switches models RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS allows a perpetrator to execute a type of attack known as “man-in-the-middle” attack.

The vulnerability of Belden Hirschmann’s network switches models RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS lies in the transmission of confidential information in the form of plain text. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attac...

CVE-2019-5106

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text...

CVE-2019-5106

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text...

Hardcoded credentials

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text...

CVE-2019-5106

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text...

CVE-2020-2157

Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2020-2157

Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2020-2151

Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2150

Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2154

Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system...

CVE-2020-2155

Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...