8837 matches found
UBUNTU-CVE-2024-6388
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext...
Astra Linux – Vulnerability in mbedtls
A vulnerability was discovered in Mbed TLS 2.x before version 2.28.7, and also in Mbed TLS 3.x before version 3.5.2. There was a timing-related side channel involved in RSA private operations. This side channel could allow a local attacker to recover the plaintext. To exploit this vulnerability,...
Bludit Security Breach
Bludit is an open source, lightweight blog content management system CMS. A security vulnerability exists in Bludit that stems from the use of the SHA-1 hash algorithm to calculate password hashes, which can be brute-force attacked by an attacker to determine plaintext passwords...
Faronics WINSelect Security Breach
Faronics WINSelect is an application from Faronics, Inc. It is used to customize the usage configuration of Windows computers. A security vulnerability previously existed in Faronics WINSelect version 8.30.xx.903, which arose from a decrypted configuration file containing a plaintext password use...
PT-2024-4651 · Jenkins · Jenkins Credentials Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Plain Credentials Plugin versions 182.v468b 97b 9dcb 8 and earlier Description: The issue is related to the storage of secret file credentials by the Jenkins Plain Credentials Plugin. In rare cases, the plugin stores these credentials...
Sensitive Information Disclosure
github.com/rancher/rancher is vulnerable to Sensitive Information Disclosure. The vulnerability is due to constantly reconciling clusters when secrets encryption configuration is enabled, causing Kube API secret values to be written in plaintext on the AppliedSpec. An attacker can gain access to...
SUSE CVE-2024-22032
A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members for projects...
Nextcloud: External storage - global credentials returned to the client side in plaintext
The security advisory reported that external storage credentials were returned to the client side in plaintext...
Multiple vulnerabilities in Toshiba Tec and Oki Electric Industry MFPs
Overview MFPs multifunction printers provided by Toshiba Tec Corporation and Oki Electric Industry Co., Ltd. contain multiple vulnerabilities listed below. Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' CWE-776 - CVE-2024-27141, CVE-2024-27142 Execution with...
CVE-2024-33375
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware...
CVE-2024-5996
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-5996
The CVE has a rejection note in the Initial Description, but connected data provides concrete details: Soar Cloud HR Portal is affected. The PT-Security entry PT-2024-37301 reports that notification emails from Soar Cloud HR Portal include links with embedded session data and are sent without enc...
CVE-2024-33375
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware...
CVE-2024-33375
CVE-2024-33375 affects LB-LINK BL-W1210M v2.0, where credentials are stored in plaintext inside the router firmware. The CVSSv3.1 base score is 9.8 (CRITICAL) with network access, no privileges, and no user interaction required. The issue originates from unencrypted storage of credentials in the ...
CVE-2024-33375
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware...
The vulnerability of the video bar and switch for Apollo VX20 video conferencing systems lies in the lack of encryption for confidential data and improper handling of exclusive conditions, allowing intruders to obtain passwords in an open form.
The vulnerability of the microprogramming software for Apollo VX20 is related to the absence of encrypted confidential data. Exploiting this vulnerability can allow a malicious actor to obtain passwords in plain text through a GET request to SoftAP/device/config...
CVE-2024-36589
An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext...
CVE-2024-36589
An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext...
CVE-2024-36589
Summary: CVE-2024-36589 involves storage of credentials in plaintext across multiple components: Annonshop.app (versions 2b2b4–ba9fd), DecentralizeJustice/anonymousLocker (2b2b4–ba9fd), and DecentralizeJustice/anonBackend (57837–cd815). The root cause is plaintext credential storage within the ci...