Improper Input Validation in Bouncy Castle

The TLS implementation in the Bouncy Castle Java library before 1.48 and C library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attack...

GHSA-V735-2PP6-H86R Ansible Logs Passwords If PowerShell ScriptBlock is Enabled

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext passwor...

Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this...

SiCKRAGE Discloses Plaintext Credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

GHSA-JRCV-3C5H-RH3Q SiCKRAGE Discloses Plaintext Credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

Jenkins Coverity Plugin has Insufficiently Protected Credentials

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...

GHSA-CGHG-JCV6-4V5M Jenkins Coverity Plugin has Insufficiently Protected Credentials

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...

Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

GHSA-5GMF-8GH2-HHFP Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...

GHSA-M833-87VF-576C ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

GHSA-2QP9-WG27-9PCV Nimbus JOSE+JWT missing overflow check

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data AAD and ciphertext so that different plaintext is obtained for the same HMAC...

GHSA-5722-V5WC-X7H8 Jenkins veracode-scanner Plugin stores credentials in plain text

Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.veracodescanner.VeracodeNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-VC2V-34C4-VG9C Jenkins Fabric-beta-publisher Plugin stores credentials in plain text

Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

Jenkins Kmap Plugin stores credentials in plain text

Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-7QM4-P377-FR2R ActiveMQ's OpenWire protocol exposes certain system details as plain text

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details such as the OS and kernel version are exposed as plain text...

Konica Minolta bizhub MFP printer 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

Konica Minolta bizhub MFP 安全漏洞

The Konica Minolta bizhub MFP printer is a series of color laser multifunction printers from the Japanese company Konica Minolta. A security vulnerability exists in the Konica Minolta bizhub MFP printer, which can be exploited by an attacker to expose the printer endpoint to sandbox escape with...

Security Bulletin: IBM MQ for HP NonStop Server is affected by vulnerability CVE-2022-22325

Summary A queue manager trace may disclose a plaintext password flowing over an MQ channel. The issue is described by CVE-2022-22325 Vulnerability Details CVEID: CVE-2022-22325 DESCRIPTION: IBM MQ can inadvertently disclose sensitive information under certain circumstances to a local user from a...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:1759)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1759 advisory. QEMU: virtio-net: heap use-after-free in virtionetreceivercu CVE-2021-3748 ntfs-3g: Out-of-bounds heap buffer access in ntfsgetattributevalue due to...