4220 matches found
CVE-2019-4307
IBM Security Guardium Big Data Intelligence SonarG 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987...
PT-2019-17028 · Ibm · Ibm Security Guardium Big Data Intelligence
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Big Data Intelligence SonarG version 4.0 Description: The issue concerns the storage of user credentials in plain text, which can be accessed by a local user. Recommendations: For IBM Security Guardium Big Data...
RHEL 7 : Red Hat Satellite 6 (RHSA-2019:3172)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3172 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...
Information Disclosure
katello is vulnerable to information disclosure. The registry credentials are captured in plain text in dynflow task during repository discovery, allowing an attacker to retrieve the credentials and gain access to the registry...
mattermost stored webhook endpoint token in plain text
Mattermost allows the definition of incoming from the perspective of the service webhook URLs. These contain what is effectively a secret token as part of the URL. mattermost stored these webhook URLs as part of its global configuration file jenkins.plugins.mattermost.MattermostNotifier.xml and j...
bitbucket-oauth stored credentials in plain text
bitbucket-oauth stored a credential unencrypted in the global config.xml configuration file on the Jenkins controller. This credential could be viewed by users with access to the Jenkins controller file system. bitbucket-oauth now stores this credential encrypted...
sonar-gerrit stored credentials in plain text
sonar-gerrit stores a credential unencrypted in job config.xml files on the Jenkins controller if the 'Override Credentials' option is used. This credential can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory,...
Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Password Stored in Clear Text vulnerability
Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4307 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG stores user credentials in plain in clear text which can be read by a local user. CVSS...
Moderate: Red Hat Security Advisory: Red Hat Satellite 6 security, bug fix, and enhancement update
An update is now available for Red Hat Satellite 6.6 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
elasticbox stores access token in plain text
elasticbox stores an access token unencrypted in the global config.xml configuration file on the Jenkins controller. This token can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there is no fix...
fortify-on-demand-uploader stores credentials in plain text
fortify-on-demand-uploader stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory there is no fix...
view26 stores access token in plain text
view26 stores an access token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory there is no fix...
neoload-jenkins-plugin stored credentials in plain text
neoload-jenkins-plugin stored credentials unencrypted in its global configuration file org.jenkinsci.plugins.neoload.integration.NeoGlobalConfig.xml and in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the...
delphix stores credentials in plain text
delphix stores credentials unencrypted in its global configuration file io.jenkins.plugins.delphix.GlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there is no fix...
Default credentials
In the Dark Horse Comics application 1.3.21 for Android, token information equivalent to the username and password is stored in the log during authentication, and may be available to attackers via logcat...
GHSA-G6WW-2X43-H963 Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...
Cross-site scripting in Apache JSPWiki
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...
CVE-2019-10139
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted...
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...
CVE-2017-12150
It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text. Mitigation The missing implied signing for smb2mount -e, smbcacls -e and smbcquotas -e can be...