8965 matches found
CVE-2012-6663
General Electric D20ME devices are not properly configured and reveal plaintext passwords...
Hardcoded Initialization Vector
Overview All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks. Recommendation The package is deprecated and will not be updated. Consider...
CVE-2019-5593
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...
CVE-2019-5593
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...
CVE-2019-5593
Fortinet FortiOS is affected by CVE-2019-5593. The flaw arises from improper permission/value checking in the CLI console, allowing a non-privileged local attacker to obtain plaintext private keys of system certificates by unsetting the encryption password for built‑in certificates (FortiOS 6.2.0...
CVE-2019-5593
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...
CVE-2019-5593
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...
Insecure Encryption
Overview parsel is a gem to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. In cases where an initialisation vector is not supplied to the encrypt or decrypt call in parsel.rb, the initialisation vector used by the library is set...
Exploit for CVE-2020-0609
This is a PoC exploit for CVE-2020-0609 and CVE-2020-0610, two v...
Arista Networks CloudVision Portal Memory Corruption Vulnerability
Arista Networks CloudVision Portal is a suite of web-based user management portals for the CloudVision platform from Arista Networks, USA. The product includes features such as network device configuration, compliance management, change management, and network monitoring and management. A securit...
Trend Micro Password Manager vulnerable to information disclosure
Overview Password Manager provided by Trend Micro Incorporated contains an information disclosure vulnerability CWE-200. Under certain conditions, the information ID, password etc. managed by Password Manager are kept on the memory in plaintext. They may be retrieved when the memory scan is done...
CVE-2012-0070
spamdyke prior to 4.2.1: STARTTLS reveals plaintext...
Code injection
spamdyke prior to 4.2.1: STARTTLS reveals plaintext...
CVE-2012-0070
CVE-2012-0070 concerns spamdyke prior to 4.2.1, where the TLS upgrade path after STARTTLS does not properly clear transport buffers, allowing insertion of arbitrary plaintext during the plaintext phase (e.g., SMTP commands). The vulnerability is triggered during the plaintext-to-TLS transition an...
CVE-2012-0070
spamdyke prior to 4.2.1: STARTTLS reveals plaintext...
CVE-2019-12399
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value,...
Cross site request forgery (csrf)
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value,...
Genexis Platinum-4410 Certification Bypass Vulnerability
The Genexis Platinum-4410 is a WiFi 300/750 Mbps triple-play GPON ONT series router. An authentication bypass vulnerability exists in Genexis Platinum-4410 2.1 P4410-V2 1.28. An attacker can exploit this vulnerability to obtain plaintext credentials from the HTML source code of the...
GitLab EE Token Plaintext Storage Vulnerability
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. A token explicit storage vulnerability exists in GitLab EE 8...