CVE-2018-18394

Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18394

CVE-2018-18394 affects Moxa ThingsPro IIoT Gateway and Device Management Software Solutions v2.1, where the system stores sensitive information in plaintext (notably tokens). The provided sources (NVD, CNVD, PRION) describe the root cause as plaintext storage, enabling an attacker to recover acce...

CVE-2018-11639

Dialogic PowerMedia XMS prior to version 3.5 SU2 suffers a vulnerability where passwords are stored in plaintext inside cookies handled by /var/www/xms/application/controllers/verifyLogin.php. This plaintext storage enables remote attackers to access user passwords in cleartext. The CVE entry cit...

CVE-2017-9654

The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3 base score: 6.5, CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N...

Code injection

The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3 base score: 6.5, CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N...

CVE-2017-8001

An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the...

Code injection

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text...

PT-2017-16342

Name of the Vulnerable Software and Affected Versions Carlo Gavazzi VMU-C EM versions prior to A11 U05 Carlo Gavazzi VMU-C PV versions prior to A17 Description An issue was discovered where sensitive information is stored in clear-text. Recommendations For Carlo Gavazzi VMU-C EM versions prior to...

CVE-2017-5146: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text...

Phoenix Contact ILC PLC Authentication Vulnerabilities

OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...

Meteocontrol WEB'log Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site. Independent researcher Karn Ganeshen has identified one authentication and two information exposure...

Moxa MiiNePort Information Disclosure Vulnerability

Moxa MiiNePort is an embedded device networking module designed for manufacturers to connect serial devices to a network connection. Moxa MiiNePort stores information in clear text and does not provide a protection mechanism, allowing an attacker to view sensitive or configuration information...

D-Link DVG­N5402SP - Multiple Vulnerabilities

Exploit Title: DLink DVG­N5402SP Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.dlink.com/ Versions Reported: Multiple - See below CVE-IDs: CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247 DLink DVG­N5402SP File Path Traversal, Weak Credentials Management, and Sensitive...

PT-2016-09: Password Access in ABB PCM600

The specialists of the Positive Research center have detected a Password Access vulnerability in ABB PCM600. After you change the Main Application Password, it is stored to the configuration file as a clear text. How to fix Update your software up to the latest version Advisory status 09.06.2015 ...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability

OVERVIEW Gleb Gritsai, Alisa Esage Shevchenko, Ilya Karpov, and the team from Positive Technologies Security have found sensitive information stored in clear text in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. Schneider Electric has released new patches t...

PT-2016-06: Information Disclosure in Advantech WebAccess

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Advantech WebAccess. Advantech WebAccess before 8.1 stores e-mail project accounts in clear text, which allows remote attackers to obtain sensitive information. How to fix Update your software...

D-Link Routers - Multiple Vulnerabilities

No description provided by source. The following five D-Link model routers suffer from several vulnerabilities including Clear Text Storage of Passwords, Cross Site Scripting and Sensitive Information Disclosure. DIR-652 D-Link Wireless N Gigabit Home Router DIR-835 D-Link Network DIR-835L Wirele...

Openfiler NAS/SAN Appliance 2.99 XSS / Traversal / Command Injection

Tested on Openfiler NAS/SAN Appliance version 2.99 Author: MiDoveteMollare Date: 10 June 2014 OS Command Injection after authentication 1 page: servicesiscsitarget.html paramenter: password POST /admin/servicesiscsitarget.html HTTP/1.1 Host: IP:446 Accept: / Accept-Language: en User-Agent:...

D-Link Routers - Multiple Vulnerabilities

The following five D-Link model routers suffer from several vulnerabilities including Clear Text Storage of Passwords, Cross Site Scripting and Sensitive Information Disclosure. DIR-652 D-Link Wireless N Gigabit Home Router DIR-835 D-Link Network DIR-835L Wireless N 750M Dual-band 802.11n 4Port...

D-Link Cross Site Scripting / Information Disclosure Vulnerability

D-Link DIR-652, DIR-835, DIR-855L, DGL-500, and DHP-1565 suffer from clear text storage of passwords, cross site scripting, and sensitive information disclosure vulnerabilities. The following five D-Link model routers suffer from several vulnerabilities including Clear Text Storage of Passwords,...