CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31816
https://notcve.org/view.php?id=CVE-2021-31816
08 Jul 2021 — When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext. Cuando se configura Octopus Server, si está configurado con una base de datos SQL externa, en la configuración inicial la contraseña de la base de datos se escribe en el archivo de registro OctopusServer.txt en texto plano • https://advisories.octopus.com/adv/2021-05---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31816%29.2121793537.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-30183
https://notcve.org/view.php?id=CVE-2021-30183
14 May 2021 — Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext. Un almacenamiento de texto sin cifrar de información confidencial en múltiples versiones de Octopus Server, donde en determinadas situaciones cuando se ejecutan procesos de importación o exportación, la contraseña usada para cifrar y descifrar valores confiden... • https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-16197
https://notcve.org/view.php?id=CVE-2020-16197
25 Aug 2020 — An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation. Se detectó un problema en Octopus Deploy versión 3.4. • https://github.com/OctopusDeploy/Issues/issues/6529 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15879
https://notcve.org/view.php?id=CVE-2020-15879
21 Jul 2020 — Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). Bitwarden Server versión 1.35.1, permite un ataque de tipo SSRF porque no considera determinadas direcciones IPv6 (las que comienzan con fc, fd, fe o ff, y la dirección ::) y determinadas direcciones IPv4 (0.0.0.0/8, 127.0.0.0/8 y 169.254.0.0/16) • https://github.com/bitwarden/server/pull/827 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19766
https://notcve.org/view.php?id=CVE-2019-19766
12 Dec 2019 — The Bitwarden server through 1.32.0 has a potentially unwanted KDF. El servidor Bitwarden versiones hasta 1.32.0, presenta un KDF potencialmente no deseado. • https://github.com/bitwarden/jslib/issues/52 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19085
https://notcve.org/view.php?id=CVE-2019-19085
18 Nov 2019 — A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML. Una vulnerabilidad de tipo cross-site scripting (XSS) persistente en Octopus Server versiones 3.4.0 hasta 2019.10.5, tiene a atacantes autenticados remotos inyectar script web o HTML arbitrario. • https://github.com/OctopusDeploy/Issues/issues/5961 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17393 – Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
https://notcve.org/view.php?id=CVE-2019-17393
16 Oct 2019 — The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password. El Customer's Tomedo Server en la versión 1.7.3, se comunica con el Vendor Tomedo Server por medio de HTTP (en texto sin cifrar) que puede ser rastreado por actores no autorizados. La autenticación básica... • https://packetstorm.news/files/id/154873 • CWE-319: Cleartext Transmission of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15508
https://notcve.org/view.php?id=CVE-2019-15508
23 Aug 2019 — In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7. En las versiones 3.0.8 a 5.0.0 de Octopus Tentacle, cuando se configura un proxy de solicitud web, un usuario autenticado (en determinadas circunstancias limitadas de OctopusPrintVaria... • https://github.com/OctopusDeploy/Issues/issues/5750 • CWE-312: Cleartext Storage of Sensitive Information CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 8%CPEs: 1EXPL: 1CVE-2018-1000881
https://notcve.org/view.php?id=CVE-2018-1000881
20 Dec 2018 — Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a self-registered user. This vulnerability appears to have been fixed in 4.1 and later. Traccar Traccar Server, en versiones 4.0 y anteriores, contiene una vulnerabilidad CWE-94: control incorrecto de la generación de c... • https://appcheck-ng.com/advisory-remote-code-execution-traccar-server • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2010-4296
https://notcve.org/view.php?id=CVE-2010-4296
06 Dec 2010 — vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain privileges via vectors involving shared object files. vmware-mount en VMware Workstation 7.x anteriores a la 7.1.2 build 301548 en Linux, VMware Player 3.1.x anteriores a la 3.1.2 build 301548 en Linux, VMware Server 2.0.2 en Linux,... • http://lists.vmware.com/pipermail/security-announce/2010/000112.html • CWE-863: Incorrect Authorization •