Alertas de Seguridad de la Información

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.

Plataformas Arista EOS ejecutando servicios OpenConfig (gNMI, gNSI, RESTCONF, NETCONF) registran inadecuadamente solicitudes y respuestas sensibles en el dispositivo local o servidores de contabilidad remota, exponiendo credenciales y configuraciones altas. La vulnerabilidad afecta infraestructuras de redes datacenter y carriers en LATAM que utilizan automatización basada en OpenConfig para gestión de equipos Arista.

Menulux Portal anterior a versión 20260903211448 almacena contraseñas en texto plano, permitiendo a atacantes acceder a credenciales sensibles si comprometen el servidor o la base de datos. Esta vulnerabilidad afecta directamente a restaurantes, bares y comercios que utilizan este sistema POS en México y Latinoamérica. El riesgo es alta para operaciones que manejan datos de clientes y empleados.

HDD password plaintext is stored in a UEFI variable.

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was pr…

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned …

update_disk_psu_baseline.sh requires password in plain text