Red Hat OpenShift Assisted Installer 日志信息泄露漏洞

Red Hat OpenShift Assisted Installer is an assisted boot installer from Red Hat USA. A security vulnerability exists in Red Hat OpenShift Assisted Installer that stems from an image pulling secret being leaked in plaintext in the installation log during the generation of the Discovery ISO...

CVE-2022-2805

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...

DEBIAN-CVE-2022-3358

OpenSSL supports creating a custom cipher via the legacy EVPCIPHERmethnew function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0...

UBUNTU-CVE-2022-3358

OpenSSL supports creating a custom cipher via the legacy EVPCIPHERmethnew function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0...

CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL encryption

OpenSSL supports creating a custom cipher via the legacy EVPCIPHERmethnew function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0...

EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2022-2537)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2022-2419)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

tiny-csrf 安全漏洞

tiny-csrf is a small csrf library by Vincent Alexander Saulys personal developer. It is intended to replace the work done by csurf before it was removed. A security vulnerability exists in versions of tiny-csrf prior to 1.1.0, which stems from the fact that cookies are not encrypted, and thus CSR...

CVE-2022-39287 Plaintext transmission of CSRF tokens in tiny-csrf

tiny-csrf is a Node.js cross site request forgery CSRF protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit 8eead6d and the patch with be included in version 1.1.0. Users are advise...

Information Disclosure

Dapr dashboard is vulnerable to information disclosure. The vulnerability is due to the dashboard's access control not being properly configured, resulting in an attacker gaining access to obtain sensitive plaintext configuration of redis, mongodb, rabbitmq and other applications on the cloud...

etcd user credentials are stored in WAL logs in plaintext

The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure...

CVE-2022-3358

OpenSSL supports creating a custom cipher via the legacy EVPCIPHERmethnew function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0...

Rocket.Chat log information leakage vulnerability

Chat is a set of open source team chat software. Rocket.Chat v4.6.4 and earlier versions contain an information disclosure vulnerability, which stems from OAuth tokens being leaked in plaintext in the logs. An attacker could use this vulnerability to obtain sensitive information...

Information Disclosure

Rancher is vulnerable to information disclosure. Confidential information such as passwords and API keys are stored in kubernetes objects using plaintext which allows an attacker with read permission to retrieve plaintext passwords using the Kubernetes API...

Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a Thunderbird user replying to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute and the content attribute specifying an URL. Thunderbird started a...

Security Bulletin: IBM Tivoli Directory Server can be affected by a vulnerability in the IBM GSKit library (CVE-2013-0169)

Abstract The Transport Layer Security protocol does not properly consider timing side-channel attacks, which allows remote attackers to conduct distinguishing attacks and plain-text recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Conte...

CVE-2022-32217

Summary: CVE-2022-32217 affects Rocket.Chat prior to v4.6.4, where an OAuth token is leaked in plaintext in logs, leading to potential information disclosure. What’s affected: Rocket.Chat versions before 4.6.4; the issue is a cleartext storage/disclosure of sensitive OAuth tokens in logs. Root ca...

Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials

Impact An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys and Rancher's service account token used to provision clusters, were stored in plaintext directly on Kubernetes objects like Clusters, for example...

GHSA-G7J7-H4Q8-8W2F Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials

Impact An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys and Rancher's service account token used to provision clusters, were stored in plaintext directly on Kubernetes objects like Clusters, for example...

Rocket.Chat 日志信息泄露漏洞

Chat is a set of open source team chat software. Rocket.Chat v4.6.4 and earlier versions contain an information disclosure vulnerability, which stems from OAuth tokens being leaked in plaintext in the logs. An attacker could use this vulnerability to obtain sensitive information...