Cross site request forgery (csrf)

A Cross Site Request Forgery CSRF vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user...

Brocade Fabric OS Information Disclosure Vulnerability

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade in the United States. An information disclosure vulnerability exists in Brocade Fabric OS versions prior to 7.4.2g. The vulnerability stems from incorrectly recording a user's...

CVE-2020-15370

Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerability is due to incorrectly logging the user password in log files...

Libstar Intelligent Library Service Platform of Jiangsu Tuxing Software Technology Limited Liability Company suffers from logic flaw vulnerability

Libstar Intelligent Library Service Platform is a library management system that utilizes a service-oriented architecture framework. Libstar Intelligent Library Service Platform of Jiangsu Tuxing Software Technology Co., Ltd. has a logic flaw vulnerability that can be exploited by an attacker to...

Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security feature bypass

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

CVE-2020-6239

Under certain conditions SAP Business One Backup service, versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure...

Information Disclosure

com.liferay.login.web is vulnerable to information disclosure. The attack exists because Sign In widget leaks user's email address and/or password allowing a malicious user to intercept the sensitive information if HTTPS is not in place...

Vesta Control Panel Elevation of Privilege Vulnerability

Vesta Control Panel VestaCP is an open source web hosting control panel. A security vulnerability exists in Vesta Control Panel 0.9.8-26 and earlier versions. The vulnerability can be exploited by an attacker to gain root privileges on the system with the help of v-change-user-password user...

CVE-2020-10787

An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password aka the user password change script...

CVE-2020-10787

An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password aka the user password change script...

Privilege escalation

An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password aka the user password change script...

Design/Logic Flaw

An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A system service allows local retrieval of the user's password. The LG ID is LVE-SMP-190009 August 2019...

Grandstream UCM6200 Series CTI Interface - (user_password) SQL Injection Exploit

Exploit for hardware platform in category web applications Exploit Title: Grandstream UCM6200 Series CTI Interface - 'userpassword' SQL Injection Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link:...

CVE-2019-12122

An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected...

CVE-2019-12122

CVE-2019-12122 affects ONAP Portal (Dublin) where calling the endpoint ONAPPORTAL/portalApi/loggedinUser can allow an attacker who has a user’s cookie to retrieve that user’s password from the database. The Red Hat and NVD entries confirm the same issue across all Portal setups. The provided docu...

CVE-2014-4660

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb...

PYSEC-2020-202

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb...

UBUNTU-CVE-2014-4660

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb...