UBUNTU-CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

DEBIAN-CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

Design/Logic Flaw

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

CVE-2017-7524

CVE-2017-7524 affects tpm2-tools before 1.1.1, where a password is transmitted in plaintext from client to server when generating an HMAC, enabling a potential password leak. Publicly documented details across connected sources confirm the affected component and root cause, with several advisorie...

Code injection

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The CVE-2017-3214 entry concerns the Milwaukee ONE-KEY Android app, where the master token is stored in plaintext inside the APK binary. Connected sources corroborate this as part of a broader set of findings in IoT security testing: the master credentials are needed to obtain a bearer token, whi...

CVE-2017-3214

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

Ctrip APP payment passwords suffer from a plaintext transmission vulnerability

Ctrip APP is a mobile client that provides users with mobile booking services for special hotels, discounted air tickets and train tickets. A plaintext transmission vulnerability exists in the payment password of Ctrip APP. Since the client does not encrypt the user's payment password, an attacke...

VMware vSphere Data Protection Local Storage vCenter Server Credentials Vulnerability

VMware vSphere Data Protection VDP is a disk-based backup and recovery solution from VMware. Integrated with VMware vCenter Server, the server and virtualization management software, the solution can be used to centrally manage backup jobs while storing backup files in deduplicated target storage...

VMware vSphere Data Protection Remote Code Execution (CVE-2017-4914)

Multiple vulnerabilities have been reported in VMware vSphere Data Protection. The vulnerabilities are due to improper Java deserialization and use of reversible encryption. A remote attacker could exploit one of the vulnerabilities by sending specially crafted data to the targeted server, which...

MGASA-2017-0166 Updated gajim packages fix security vulnerability

Gajim unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, which may be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions CVE-2016-10376...

CVE-2017-4917

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained...

Design/Logic Flaw

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained...

CVE-2017-4917

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained...

CVE-2016-5960

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 116171...

Multiple Peplink Balance products are vulnerable to plaintext storage of passwords

Explicitly Stored Password Vulnerabilities The Balance 305 and others are multi-exit load balancing routers used in mid-sized businesses. Present in several Peplink Balance products using firmware versions prior to fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093, the vulnerability stems...