3455 matches found
CVE-2019-10139
CVE-2019-10139 affects cockpit-ovirt: during hosted engine deployment, cockpit-ovirt creates an ansibleVarFileXXXXXX.var containing admin and appliance passwords in plain text at /var/lib/ovirt-hosted-engine-setup/cockpit/. These files are deleted at the end of deployment, but during exposure the...
CVE-2019-10139
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted...
PT-2019-5508 · Red Hat · Cockpit-Ovirt
Name of the Vulnerable Software and Affected Versions: cockpit-ovirt affected versions not specified Description: The issue is related to insufficient protection of registration data in the cockpit-ovirt plugin of the Red Hat Virtualization management software. During HE deployment, an Ansible...
Information Disclosure
Thunderbird ESR and Thunderbird are vulnerable to information disclosure. A remote attacker is able to read plaintext of decrypted emails which leak through by user submitting an embedded form...
RSA NetWitness Authorization Bypass
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authorization Bypass product: RSA NetWitness vulnerable version: 10.6.6.1, 11.2.1.1 fixed version: 10.6.6.1, 11.2.1.1 CVE number: CVE-2019-3724 impact: Medium homepage:...
'Unhackable' Biometric USB Offers Up Passwords in Plain Text
A USB stick dubbed eyeDisk that uses iris recognition to unlock the drive claims to be “unhackable” – only, it isn’t. In fact, a simple Wireshark analysis revealed the device’s password – in plain text. David Lodge of Pen Test Partners noticed the product on Kickstarter, where it amassed enough...
DEBIAN-CVE-2019-11499
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message...
CVE-2019-11499
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message...
ALPINE-CVE-2019-11499
In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message...
CVE-2019-11499
The CVE-2019-11499 issue affects Dovecot’s IMAP server (submission-login) where AUTH PLAIN over TLS with an unacceptable authentication message causes a crash in Dovecot 2.3.3–2.3.5.2. Connected advisories (openSUSE/SUSE/NASL entries) confirm a fix was released (e.g., dovecot23 updates for SUSE/o...
Freedom Mobile leaked millions of card data with CVV codes in plain text
By Uzair Amir The company claims it does not share user data with others but looks like it does. Another day, another data breach; this time an unprotected database has been discovered leaking personal and financial data of millions of Canadians. Identified by researchers at vpnMentor along with...
IBM BigFix Platform 9.5.x < 9.5.10 Plain Text Credentials
According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.5.x prior to 9.5.10. It is therefore affected by an information disclosure vulnerability as a result of storing user credentials in plain text, which could be read by an authenticated...
XML External Entity (XXE)
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. Apache CXF is an open source services framework, which is a part of Red Hat JBoss Enterprise Application Platform. It was found that the SecurityTokenService STS, provided as a...
Information Disclosure
Aeolus Configuration Server is vulnerable to information disclosure. Passwords are stored in plain text in the world-readable /var/log/aeolus-configserver/configserver.log file. A local attacker could use this flaw to obtain the administrative passwords for other services...
Weak Authentication
An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...
Information Disclosure
An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...
Improper Input Validation in tar-fs
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...
CVE-2018-20835
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...
CVE-2018-20835
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...
CVE-2018-20835
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...