CVE-2017-15918

Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks...

CVE-2017-15918

Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks...

Design/Logic Flaw

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

CVE-2017-1000245

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

CVE-2017-1000245

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

CVE-2017-1000245

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

CVE-2017-1000245

Summary: CVE-2017-1000245 affects the Jenkins SSH Plugin, where user passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file. This credential storage flaw can lead to disclosure of sensitive credentials used to access remote servers. The provided connected...

Telegram Messenger for iOS and Android Information Disclosure Vulnerability

Telegram Messenger for iOS and Android is a suite of mobile messaging tools based on the iOS and Android platforms. An information disclosure vulnerability exists in Telegram Messenger version 2.6 for iOS and Telegram Messenger version 1.8.2 for Android. The vulnerability can be exploited to obta...

NQ Contacts Backup&Restore Information Disclosure Vulnerability

NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates from the program's use of a DES encryption algorit...

NQ Contacts Backup&Restore Information Disclosure Vulnerability (CNVD-2017-35644)

NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates when the program passes a plaintext username along...

CVE-2015-0226

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this...

UBUNTU-CVE-2015-0226

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this...

CVE-2015-0226

CVE-2015-0226 affects Apache WSS4J: versions pre-1.6.17 and pre-2.0.x before 2.0.2 leak information about decryption failures when decrypting an encrypted key or message data, enabling an attacker to recover plaintext for a symmetric key via crafted messages. Root cause traces to an incomplete fi...

CVE-2015-0226

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2017-32856)

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. An information disclosure vulnerability exists in IBM BigFix Platform 9.2 and 9.5. The vulnerability arises because the software communicates sensitive or safety-critical data in plaintext over a channel tha...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 62.0.3202.74 Platform version: 9901.54.0/1 for most Chrome OS devices. This build contains a number of bug fixes and security updates. Systems will be receiving updates over the next several days. New Features Kerberos SSO integration for Active Directory...

Aescrypt does not sufficiently use random values

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack...

GHSA-4C4W-3Q45-HP9J Aescrypt does not sufficiently use random values

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack...

AVTech Multiple Vulnerabilities

The remote AVTech device is affected by multiple vulnerabilities. Depending on the firmware version the vulnerabilities may include: - All user passwords are stored in cleartext - The web interface does not use CSRF protections - An attacker is able to perform arbitrary HTTP requests through the...

OpenJDK: use of unprotected sname in Kerberos client (Libraries, 8178794)

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java...