Information Disclosure

foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...

Information Disclosure

spring-security-core is vulnerable to Information Disclosure. The vulnerability exists as it uses a fixed null initialization vector with CBC Mode for the queryable text encryptor rather than handling the null value passed to the function BCryptPasswordEncoder.encode, thereby allowing a user with...

Kubernetes: Plaintext storage of a password on kubernetes release bucket

Report Submission Form Summary: During my recon I found these two buckets dl.k8s.io and dl.kubernetes.io which actually redirects to https://storage.googleapis.com/kubernetes-release/. By searching the string "password" under https://storage.googleapis.com/kubernetes-release/ I found a file calle...

Unspecified Vulnerability in Blaauw Remote Kiln Control (CNVD-2020-28486)

The Blaauw Remote Kiln Control is an automated ceramic kiln controller from Blaauw in the Netherlands. An unspecified vulnerability exists in Blaauw Remote Kiln Control. An attacker can exploit this vulnerability to access MySQL credentials in plaintext in /engine/db.inc, /lang/nl.bak, or...

Wavlink WL-WN530HG4 Information Disclosure Vulnerability (CNVD-2020-41784)

WAVLINK WL-WN530HG4 is a wireless network signal extender from China RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WL-WN530HG4 M30HG4.V5030.191116 version. The vulnerability can be exploited by an attacker to obtain the current administrator password in plaintext form in t...

HCL Technologies Nomad Information Disclosure Vulnerability

HCL Technologies Nomad is an application from HCL Technologies India for using, managing Domino application development platform in mobile devices. A security vulnerability exists in HCL Technologies Nomad for Android and iOS platforms, which stems from the fact that the software communicates in...

Security Bulletin: Vulnerability in SSLv3 affects Rational DOORS Web Access (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 can be enabled in IBM Rational DOORS Web Access. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts lik...

Sonatype Nexus Repository Manager Information Disclosure Vulnerability (CNVD-2020-33469)

Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used to manage, store, and distribute software, among other things. A security vulnerability exists in Sonatype NXRM version 2.x prior to 2.14.17 and version 3.x prior to 3.22.1. An attacker can exploit the...

TestLink has an unspecified vulnerability

TestLink is the TestLink team's set of open source software for managing the software testing process and providing statistical analysis. An unspecified vulnerability exists in TestLink. An attacker can exploit this vulnerability to obtain credentials in plaintext with the 'viewer' parameter of t...

ABB Telephone Gateway TG/S and Busch-Jaeger Telefon-Gateway Unprotected Credential Storage Vulnerability

The ABB Telephone Gateway TG/S and the Busch-Jaeger 6186/11 Telefon-Gateway are both a telephone gateway product from ABB Switzerland. A security vulnerability exists in the backup feature in ABB Telephone Gateway TG/S version 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway, which stems from the...

CVE-2019-19105

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...

CVE-2019-19107

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

Design/Logic Flaw

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...

Design/Logic Flaw

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

CVE-2019-19107 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Information Exposure

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

CVE-2019-19107

CVE-2019-19107 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. Connected records describe that configuration pages for user profiles and services transfer the password in plaintext (hidden in the UI) during access, constituting an information-disclosure issue. Mul...

CVE-2019-19105

CVE-2019-19105 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The backup feature stores the application’s current settings and credentials (including user accounts and other configuration credentials) in plaintext, exposing confidentiality. Exploitation details a...

IBM UrbanCode Deploy Credential Stealing Vulnerability

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

The vulnerability of the implementation of the HMAC-SHA-384 mechanism in the GnuTLS cryptographic library allows a perpetrator to carry out an “Lucky 13” attack and a attack that recovers the plaintext.

The vulnerability of the implementation of the HMAC-SHA-384 mechanism in the GnuTLS cryptographic library is related to errors in the implementation of the cryptographic algorithm. Exploiting this vulnerability allows a malicious actor to perform both a “Lucky 13” attack and an attack that recove...

The vulnerability of the implementation of the HMAC-SHA-256 mechanism in the GnuTLS cryptographic library allows a perpetrator to carry out an “Lucky 13” attack and a attack that recovers the plaintext.

The vulnerability of the HMAC-SHA-256 mechanism implemented in the GnuTLS cryptographic library is related to errors in the implementation of the cryptographic algorithm. Exploiting this vulnerability allows a malicious actor to perform both a “Lucky 13” attack and an attack that recovers the...