CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

MarcomCentral FusionPro VDP Creator Path Traversal Vulnerability

MarcomCentral FusionPro VDP Creator is a variable data publishing design and layout tool from MarcomCentral USA. A directory traversal vulnerability exists in the FPProducerInternetServer.exe service/utility in MarcomCentral FusionPro VDP Creator versions prior to 10.0. A remote attacker could us...

Ansible User Module Information Disclosure Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and organize computer systems.User module is one of the user modules. An information disclosure vulnerability exists in the User module in Ansible. The vulnerability can be exploited by an...

Unprotected VOIP Server Exposed Millions of SMS Messages, Call Logs

A California-based Voice-Over-IP VoIP services provider VOIPO has accidentally left tens of gigabytes of its customer data, containing millions of call logs, SMS/MMS messages, and plaintext internal system credentials, publicly accessible to anyone without authentication. VOIPo is one of a leadin...

CloudBees Jenkins Artifactory Plugin Disk Unencryption Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor ongoing software releases/testing projects and some timed tasks.Artifactory Plugin is a plugin that is used to release, parse and Publish traceable bui...

Authorization

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource...

CVE-2018-17245

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource...

Versa Networks: Plaintext Credentials in Backups & Configs

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for various application components such as SNMP, and SSL and Trust keystores...

Information Disclosure

kibana is vulnerable to information disclosure attacks. The vulnerability exists as plaintext credentials are being sent in the HTTP request during the PDF generation process, allowing an external resource provider to view the credentials...

CVE-2018-17922

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2018-24842)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardium version 10.5...

Puppet Enterprise Plaintext Transfer Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A plaintext transfer vulnerability...

CVE-2018-11749

CVE-2018-11749 affects Puppet Enterprise when startTLS with RBAC LDAP is configured; at login time, user credentials are sent in plaintext to the LDAP server. Affected PE versions: 2018.1.3, 2017.3.9, and 2016.4.14. Fixes are available in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. Seve...

CVE-2018-11749

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS...

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines Information Disclosure Vulnerability

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines are both products of Dell Dell. The former is a suite of disaster recovery and data protection software, and the latter is a disaster recovery solution for VMware environments. An information disclosure vulnerability exists in Dell EMC...

UTStar WA3002G4 Authentication Bypass Vulnerability

The UTStar WA3002G4 is a modem from UTStarcom USA. An authentication bypass vulnerability exists in the UTStar WA3002G4. An attacker can use this vulnerability to directly access administrator settings and obtain plaintext credentials from the HTML source...

IBM Cognos Business Intelligence Information Disclosure Vulnerability

IBM Cognos Business Intelligence BI is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing key factors and key stakeholders. A security vulnerability...

IBM Tivoli Identity Manager and Security Identity Manager Information Disclosure Vulnerability (CNVD-2018-08708)

IBM Tivoli Identity Manager and Security Identity Manager are both products of IBM Corporation of the U.S.A. IBM Tivoli Identity Manager is a suite of identity management software used to manage user rights across heterogeneous IT resources.Security Identity Security Identity Manager is an identi...

UbiQuoss Switch VP5208A Unauthorized Operation Vulnerability

UbiQuoss Switch VP5208A is a switch product from UbiQuoss Korea. A security vulnerability exists in the UbiQuoss Switch VP5208A, which originates from a user login failure where the program creates a bcmpassword file with user credentials in plaintext in /cgi-bin/. An attacker can obtain the...