CVE-2014-0647

The Starbucks iOS app version 2.6.1 stores credentials and other sensitive user data in plaintext inside the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog). The data exposed include usernames, email addresses, and passwords, enabling an attack...

[Hasher v1.0.3] Python tool to locally generate / compare password hashes

Hasher is a tool designed to quickly generate hashes from a plaintext string in a variety of hash formats. It also can quickly compare a plaintext string to a hash value of a specific hash type to determine if they are a match. Hasher was designed to be a way to locally generate or compare passwo...

echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure

echor Gem for Ruby contains a flaw that is due to the program exposing credential information in the system process listing. This may allow a local attacker to gain access to plaintext credential information...

NETGEAR WNR1000v3 Password Disclosure Vulnerability

Newer firmware versions of the Netgear N150 WNR1000v3 wireless router are affected by a password recovery vulnerability. Exploiting this vulnerability allows an attacker to recover the router SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced...

MySQL debian.cnf Plaintext Credential Disclosure

The version of MySQL installed on the remote host is 5.5.x prior to 5.5.33. It is, therefore, potentially affected by a race condition in the post-installation script of the MySQL server package mysql-server-5.5.postinst that creates the configuration file '/etc/mysql/debian.cnf' with...

CVE-2013-6394

Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector IV, which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks...

CVE-2013-6394

Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector IV, which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks...

Code injection

Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector IV, which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks...

UBUNTU-CVE-2013-6394

Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector IV, which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks...

CVE-2013-6394

Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector IV, which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks...

CVE-2013-6394

Percona XtraBackup had an IV handling flaw (constant IV) up to 2.1.6, enabling plaintext-attacks against encrypted backups. The issue is acknowledged as a result of an incomplete fix; later advisories indicate that xbcrypt in 2.3.6 and 2.4.x before 2.4.5 does not properly set the IV, implying an ...

Safari Stores Previous Browsing Session Data Unencrypted

Users of Apple’s Safari browser are at risk for information loss because of a feature common to most browsers that restores previous sessions. The problem with Safari is that it stores session information including authentication credentials used in previous HTTPS sessions in a plaintext XML file...

SuSE 11.3 Security Update : openvpn (SAT Patch Number 8493)

OpenVPN used a non-constant-time memcmp in HMAC comparison in openvpndecrypt that might have allowed remote attackers to gain knowledge of plaintext data. CVE-2013-2061 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandriva Linux Security Advisory : nss (MDVSA-2013:270)

Multiple security issues was identified and fixed in mozilla NSPR and NSS : Mozilla Network Security Services NSS before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified othe...

GLSA-201311-13 : OpenVPN: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201311-13 OpenVPN: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenVPN. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to recover plaintext from...

Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities

Updated nspr and nss packages fix security vulnerabilities: Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets CVE-2013-5605. The CERTVerifyCert function in...

Cupid Media Hacked, Plaintext Passwords Stolen

Hackers reportedly breached servers in January belonging to Cupid Media, a niche dating service with 30 million users, stealing more than 42 million unencrypted passwords and various other sensitive data. Cupid Media operates a variety of niche dating sites based on ethnicity, religion, physical...

OpenVPN: Multiple vulnerabilities

Background OpenVPN is a multi-platform, full-featured SSL VPN solution. Description Multiple vulnerabilities have been discovered in OpenVPN. Please review the CVE identifiers referenced below for details. Impact A remote attacker may be able to recover plaintext from an encrypted communication...

ARRIS DG860A NVRAM Backup Password Disclosure

Exploit for hardware platform in category web applications ! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain...

GLSA-201310-18 : GnuTLS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201310-18 GnuTLS: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. Impact : A remote attacker could...