| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| CloudForms stores user passwords in recoverable format |
| (1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp. |
| The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
| Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks |
| Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312. |
| The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311. |
| Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords. |
| webauth before 4.6.1 has authentication credential disclosure |
| Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability |
| OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability |
| Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories. |
| The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo. |
| Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. |
| The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg. |
| General Electric D20ME devices are not properly configured and reveal plaintext passwords. |
| The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effort. |
| ipa 3.0 does not properly check server identity before sending credential containing cookies |
| Claws Mail vCalendar plugin: credentials exposed on interface |
| Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved. |
| Hadoop 1.0.3 contains a symlink vulnerability. |
