Archive
May 2019
Vulnerabilities first published in this month (UTC), newest first.
11 results · Clear filters · Feed
-
Low —
Cross-Site Scripting in public
All versions of `public` are vulnerable to stored cross-site scripting (XSS). ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
-
Low 3.3
Insecure Credential Storage in web3
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this …
-
Low 2.8
BlueCats Reveal iOS App Insecure Storage
The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected Bl…
-
Low 2.8
BlueCats Reveal Android App Insecure Storage
The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to…
-
Low 2.8
Eaton Halo Home Android App Insecure Storage
The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker t…
-
Low 2.7
IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information a…
-
Low 3.3
IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a loca…
-
Low 3.1
IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster…
-
Low —
Alkacon OpenCMS XSS via New User module
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp). This allows an attacker to insert arbitrary JavaScript as user input (First Name or Last Name),…
-
Low 3.7
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically…
-
Low 3.5
Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parame…