CVE-2022-23234

SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HANA credentials...

GHSA-X75R-G63M-82WJ Passwords stored in plain text by Jenkins dbCharts Plugin

Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller...

Personal tokens stored in plain text by Jenkins incapptic connect uploader Plugin

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Hades RAT Web Panel Insecure Credential Storage Vulnerability

Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt Contact: email protected Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Insecure Credential Storage Family: Hades Type: WebUI MD5: c4cc1317aea42f7dd4a1b786c5278a24 MD5:...

Hades RAT Web Panel Insecure Credential Storage

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Hades RAT - Web Panel Vulnerability: Insecure Credential Storage Family: Hades Type: WebUI MD5:...

FreeTAKServer-UI SQL Injection Vulnerability

FreeTAKServer-UI is an open source FTS web interface from the FreeTAKTeam team.FreeTAKServer-UI is vulnerable to SQL injection, which stems from the API endpoint/AuthenticateUser containing SQL injection into the SQLite3 database, which can be exploited by an attacker to obtain the database All...

AlmaLinux 8 : samba (ALSA-2021:5082)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5082 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire...

CVE-2021-41849

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information PII in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity IMEI. This PII is transmitted to...

Information disclosure

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information PII in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity IMEI. This PII is transmitted to...

Apache Spark Encryption Problem Vulnerability (CNVD-2022-21823)

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

PT-2022-11500 · Luna Simo · Luna Simo

Name of the Vulnerable Software and Affected Versions: Luna Simo PPR1.180610.011/202001031830 Description: An issue was discovered in Luna Simo where it sends Personally Identifiable Information PII in plaintext using HTTP to servers located in China. The PII includes the user's list of installed...

CVE-2022-0725

A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs...

UBUNTU-CVE-2022-0725

A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs...

Apache Spark 加密问题漏洞

Apache Spark is a multilingual engine for performing data engineering, data science, and machine learning on a single-node machine or cluster. Apache Spark is vulnerable to an encryption issue that stems from the program's use of a custom mutual authentication protocol that allows fully encrypted...

AVEVA System Platform 安全漏洞

AVEVA System Platform is an application from AVEVA UK. A responsive, standards-driven and scalable foundation for regulatory, enterprise SCADA, MES and IIoT applications. A security vulnerability exists in AVEVA System Platform, the successful exploitation of which could expose the plaintext...

CVE-2022-25218

The CVE-2022-25218 entry concerns PHICOMM router devices (e.g., K2, K3, K3C) where telnetd_startup uses RSA without OAEP or padding. An unauthenticated attacker on the LAN can craft UDP packets to influence the OpenSSL RSA_public_decrypt() processing, manipulating the telnetd startup state machin...

CVE-2022-25218

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetdstartup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's...

Rhinode Trading Paints 安全漏洞

Rhinode Trading Paints is used by Rhinode USA to add customized car paint to iRacing. A security vulnerability exists in Rhinode Trading Paints versions prior to 2.0.36, which stems from the fact that TP Updater.exe uses plaintext HTTP to check for and request updates. As a result, an attacker...

HCL BigFix Insights 安全漏洞

HCL BigFix Insights is HCL India's accelerates risk identification and decision making through elevated views of endpoint queue data, rich reporting and integration with existing business intelligence tools. HCL BigFix Insights has a security vulnerability that stems from the application storing...

CVE-2021-3716

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the server, potentially leading the client to terminat...