Jenkins Kmap Plugin stores credentials in plain text

Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-7QM4-P377-FR2R ActiveMQ's OpenWire protocol exposes certain system details as plain text

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details such as the OS and kernel version are exposed as plain text...

Konica Minolta bizhub MFP printer 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

Konica Minolta bizhub MFP 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

Security Bulletin: IBM MQ for HP NonStop Server is affected by vulnerability CVE-2022-22325

Summary A queue manager trace may disclose a plaintext password flowing over an MQ channel. The issue is described by CVE-2022-22325 Vulnerability Details CVEID: CVE-2022-22325 DESCRIPTION: IBM MQ can inadvertently disclose sensitive information under certain circumstances to a local user from a...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:1759)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1759 advisory. QEMU: virtio-net: heap use-after-free in virtionetreceivercu CVE-2021-3748 ntfs-3g: Out-of-bounds heap buffer access in ntfsgetattributevalue due to...

RHEL 8 : dovecot (RHSA-2022:1950)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1950 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and...

dovecot: plaintext commands injection

It was found that dovecot could still accept plaintext commands while the STARTTLS negotiation process is ongoing. This could allow an active person in the middle, with valid credentials on dovecot, to, for example, steal confidential data such as the client's emails and passwords...

Moderate: Red Hat Security Advisory: dovecot security update

An update for dovecot is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the server, potentially leading the client to terminat...

Default credentials

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...

CVE-2022-24045

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The application, after a successful login, sets the session cookie on the browser...

CVE-2022-24041

CVE-2022-24041 affects Siemens Desigo DXR2, PXC3, PXC4 and PXC5 devices. The vulnerability stems from storing PBKDF2 password hashes with a low iteration count, enabling an attacker with user-profile access to retrieve other accounts’ password hashes and perform offline cracking to recover plaint...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

RLSA-2022:1950 Moderate: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. The following packages...

多款Siemens产品安全漏洞

Desigo DXR2 controllers are programmable automation stations to support the standard control needs of end HVAC equipment and TRA Total Room Automation applications. the Desigo PXC3 series of automation stations can be used in buildings where functionality and flexibility are more demanding. Use...

CentOS 8 : dovecot (CESA-2022:1950)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1950 advisory. - dovecot: plaintext commands injection CVE-2021-33515 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CVE-2022-28162

Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1675)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-2124

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. Mitigation Ensure the following global smb.conf parameters are set to their default values as show...