| Package | Affected versions | Patched versions |
|---|---|---|
| bacula | ≤ 2.2.5 |
make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free