CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-50974
https://notcve.org/view.php?id=CVE-2023-50974
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials. En Appwrite CLI anterior a 3.0.0, cuando se utiliza el comando de inicio de sesión, las credenciales del usuario de Appwrite se almacenan en un archivo ~/.appwrite/prefs.json con 0644 como permisos UNIX. Cualquier usuario del sistema local puede acceder a esas credenciales. • https://appwrite.io/docs/tooling/command-line/installation https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-41092 – Docker CLI leaks private registry credentials to registry-1.docker.io
https://notcve.org/view.php?id=CVE-2021-41092
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. • https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10256
https://notcve.org/view.php?id=CVE-2020-10256
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption. Se detectó un problema en las versiones beta de la herramienta de línea de comandos 1Password versiones anteriores a 0.5.5 y en las versiones beta de 1Password SCIM bridge anteriores a 0.7.3. Se usó un generador de números aleatorios no seguro para generar varias claves. • https://support.1password.com/command-line https://support.1password.com/kb/202010 https://support.1password.com/scim •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3781 – CF CLI does not sanitize user's password in verbose/trace/debug
https://notcve.org/view.php?id=CVE-2019-3781
Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password. Cloud Foudry CLI, en versiones anteriores a v6.43.0, expone contraseñas de manera incorrecta cuando verbose/trace/debugging está habilitado. Un usuario no autenticado o un usuario remoto autenticado malicioso con acceso a los logs podría obtener parte o toda la contraseña de un usuario. • http://www.securityfocus.com/bid/107365 https://www.cloudfoundry.org/blog/cve-2019-3781 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-215: Insertion of Sensitive Information Into Debugging Code •