CVE-2024-1742

LOW Year: 2024
CVSS v3 Score
3.3
Low
Weakness Type
CWE-214
View all →

Vulnerability Description

Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.

Related Vulnerabilities

CVE-2018-16837

HIGH
CVSS:7.8(High)

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen...

CWE-2142018

CVE-2018-17957

HIGH
CVSS:7.8(High)

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RM...

CWE-2142018

CVE-2020-36771

HIGH
CVSS:7.8(High)

CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authentication token via the process list and ...

CWE-2142020

CVE-2021-3859

HIGH
CVSS:7.5(High)

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

CWE-2142021

CVE-2024-28799

HIGH
CVSS:7.5(High)

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in non default configurat...

CWE-2142024

CVE-2019-3869

HIGH
CVSS:7.2(High)

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks cou...

CWE-2142019