CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

Design/Logic Flaw

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...

CVE-2019-10165

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources...

Unspecified Vulnerability in NCH Software Express Invoice

NCH Software Express Invoice is an inventory system from NCH Software Australia. The system is mainly used for invoice management, etc. A security vulnerability exists in NCH Software Express Invoice version 7.25, which stems from the program storing passwords in plaintext form. This vulnerabilit...

GnuTLS Encryption Problem Vulnerability

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. An encryption issue vulnerability exists in versions prior to GnuTLS 3.6.13. The vulnerability stems from a network system or product that does not properly use the relevant cryptographic algorithms,...

CVE-2017-17688

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

Unspecified Vulnerability in Deskpro (CNVD-2020-22251)

Deskpro is a helpdesk software solution that helps companies manage communication with their customers and user base across multiple channels. A security vulnerability exists in Deskpro versions prior to 2019.8.0 that stems from the /api/emailaccounts endpoint failing to properly validate user...

Unisoon UltraLog Express Sensitive Data Disclosure Vulnerability

Unisoon UltraLog Express is a telephone recording system from Unisoon, Taiwan, China. A security vulnerability exists in Unisoon UltraLog Express, which is caused by the management software storing user information in plaintext. The vulnerability can be exploited by an attacker to gain access to...

spring-security-core: mishandling of user passwords allows logging in with a password of NULL

A flaw was found in Spring Security in several versions, in the use of plain text passwords using the PlaintextPasswordEncoder. If an application is using an affected version of Spring Security with the PlaintextPasswordEncoder and a user has a null encoded password, an attacker can use this flaw...

It-novum OpenITCOCKPIT Encryption Issues Vulnerability

It-novum OpenITCOCKPIT is a set of open source system monitoring tools from Germany's It-novum. An encryption issue vulnerability exists in It-novum openITCOCKPIT versions prior to 3.7.3. The vulnerability stems from a network system or product that does not properly use the relevant cryptographi...

Important: Red Hat Security Advisory: Red Hat AMQ Streams 1.4.0 release and security update

Red Hat AMQ Streams 1.4.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

kafka: Connect REST API exposes plaintext secrets in tasks endpoint

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value,...

Unspecified vulnerability in rConfig (CNVD-2020-22276)

rConfig is an open source network configuration management utility . A security vulnerability exists in the includes/head.inc.php file in versions of rConfig prior to 3.9.4, which can be exploited to retrieve stored credentials in plaintext form by sending a GET request to the settings.php file...

Design/Logic Flaw

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real...

CVE-2019-15653

The CVE-2019-15653 entry affects Comba AP2600-I devices (through A02,0202N00PD2). The root issue is an insecure authentication mechanism that exposes credentials via the login page’s HTML source, where usernames and passwords are derivable; specifically, usernames/passwords are the double MD5 of ...

Information Disclosure

djangonopassword is vulnerable to information disclosure. The vulnerability exists because it stores the sensitive login codes in the database and compares the codes in plaintext formats at the time of login...

Broadcom Wi-Fi Devices - (KR00K) Information Disclosure Exploit

Kr00ker Experimetal KR00K PoC in python3 using scapy Description: This script is a simple experiment to exploit the KR00K vulnerability CVE-2019-15126, that allows to decrypt some WPA2 CCMP data in vulnerable devices. More specifically this script attempts to retrieve Plaintext Data of WPA2 CCMP...

Broadcom Wi-Fi Devices - 'KR00K Information Disclosure

Kr00ker Experimetal KR00K PoC in python3 using scapy Description: This script is a simple experiment to exploit the KR00K vulnerability CVE-2019-15126, that allows to decrypt some WPA2 CCMP data in vulnerable devices. More specifically this script attempts to retrieve Plaintext Data of WPA2 CCMP...