SonarQube - Authentication Bypass

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. id: CVE-2020-27986 info: name: SonarQube - Authentication Bypass author: pikpikcu severity: high description: | SonarQube 8.4.2.36762 allows remote attackers to...

kyocera-cve-2022-1026

kyocera-cve-2022-1026 Kyocera 打印机中存在一个未认证的数据提取漏洞，该漏洞允许恢复明文形式的通讯录和域绑定密码。 漏洞概述 早在 2021 年的一次渗透测试中，我在摆弄 Kyocera 用于远程管理打印机的胖客户端应用程序。在对该应用程序的流量进行代理时，我发现 Kyocera 在 9091/TCP 端口上的 SOAP API 在执行敏感操作时未正确处理身份验证。Kyocera MFP 可以配置用于公司域绑定的凭据、FTP 凭据、文件共享凭据等。在未认证的情况下，可以以明文形式检索 MFP 存储的所有凭据。 我的完整分析文章可在 Rapid7...

CVE-2024-42657

CVE-2024-42657 CVE-2024-42657 wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 中的一个问题允许远程攻击者通过登录过程中缺乏加密的方式获取敏感信息。 CVE-2024-42657: 摘要：wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 中的一个漏洞允许未经身份验证的远程攻击者在登录过程中获取敏感信息。该问题源于登录凭证传输时缺乏加密，使其容易通过中间人（MITM）攻击被截获。 详情：wishnet Nepstech Wifi Router...

NetworkAlarm

NetworkAlarm ローカルネットワークトラフィックを監視し、潜在的なセキュリティ脆弱性を検出するコマンドラインツール。nmapスキャン、Niktoスキャン、平文で送信された資格情報、平文で送信されたクレジットカード番号、Shellshock攻撃に対する警告をユーザーに通知します。現在、ライブ監視とネットワークキャプチャ（pcap）スキャンをサポートしています。 脆弱性監視 nmapスキャン NULL、FYN、XMASステルス攻撃から保護 注: ステルス性のないスキャンは保護対象外です。サーバーログでスキャンの有無を確認してください Niktoスキャン...

CVE-2019-17662

CVE-2019-17662 描述 ThinVNC 1.0b1 存在任意文件读取漏洞，可导致VNC服务器被攻破。即使在部署VNC服务器时开启了身份验证，该漏洞仍然存在。用于身份验证的密码以明文形式存储在一个可通过 ../../ThinVnc.ini 目录遍历攻击向量读取的文件中。 NIST 如何编译利用程序 $ git clone https://github.com/whokilleddb/CVE-2019-17662 $ cd CVE-2019-17662 $ make 使用方法 $ ./bin/CVE-2019-17662 -h Usage: ./CVE-2019-17662 -u...

CVE-2019-17662-Exploit

CVE-2019-17662 描述 ThinVNC 1.0b1 存在任意文件读取漏洞，可导致 VNC 服务器被攻破。即使在部署 VNC 服务器时开启了身份验证，该漏洞仍然存在。身份验证密码以明文形式存储在一个可通过 ../../ThinVnc.ini 目录遍历攻击向量读取的文件中。 NIST 用法 $ ./bin/CVE-2019-17662 -h 用法: ./CVE-2019-17662 -u URL -f 文件 选项: 选项 描述 -u URL Base URL -f 文件 可选 要查询的文件名 默认: ThinVnc.ini $ ./bin/CVE-2019-17662 -u...

sickrageWTF

SickRage 明文 GitHub 凭据漏洞 CVE-2018-9160 1. 关于 漏洞标题：SickRage 在 HTTP 响应中返回明文凭据 日期：2018-04-01 漏洞作者：Sven Fassbender 联系方式：https://twitter.com/mezdanak 厂商主页：https://sickrage.github.io 软件链接：https://github.com/SickRage/SickRage 版本： ... input type="text" name="gitusername" id="gitusern...

CVE-2024-56428

CVE-2024-56428 iLabClient 本地数据库中的明文凭据 读取包含密码的配置 iLabClient 用于从实验室服务器下载结果。配置数据 存储在本地 Apache Derby 实例 iLabClient 中。密码以明文形式存储。为了能够读取该密码，必须首先建立到本地数据库的连接，例如按照 CVE-2024-56429 中描述的方式操作。 读取密码： select EINSTELLUNGEN from configs; 自动化脚本 可以执行 getconfigs.sh 脚本以读取配置数据。需要注意的是， 在执行期间，不得有其他程序（例如 iLabClient...

PT-2026-99217

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions prior to 2026.8.11 Description The application stores Gateway credentials as cleartext JSON within App Group UserDefaults rather than using the secure device Keychain. This allows attackers who obtain unencrypted devi...

CVE-2026-63207

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured...

CVE-2026-63207

The open-source helpdesk system Zammad versions 7.0.3 and 7.1.1 is vulnerable to sensitive information exposure. An authenticated administrator can exploit the integration administration API to obtain stored integration credentials in cleartext . The root cause is that certain API responses fail ...

CVE-2026-63207 Zammad: Sensitive Information Exposure in Integration Administration API

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured...

CVE-2026-63207: Exposure of Sensitive Information to an Unauthorized Actor

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured...

CVE-2026-14442

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

CVE-2026-14442: Insertion of Sensitive Information into Log File

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

CVE-2026-92882: Insufficiently Protected Credentials

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

Information exposure vulnerability in the job scheduling component of Brocade SANnav

An information exposure vulnerability in the job scheduling component of Brocade SANnav versions before 3.0.1a allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters are logged...

CVE-2025-56566

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the...

EUVD-2025-210925

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An...

CVE-2025-56565

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An...