927 matches found
Directory traversal
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a...
CVE-2019-17662
ThinVNC 1.0b1 is vulnerable to an arbitrary file read via a ../../ThinVnc.ini directory traversal, allowing an attacker to read the password file and bypass authentication even when authentication is enabled. The root cause is a directory traversal flaw that exposes the authentication file in cle...
CVE-2019-9532
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal...
Default credentials
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal...
CVE-2019-15023
CVE-2019-15023 affects Palo Alto Networks Zingbox Inspector 1.294 and earlier, where passwords for 3rd‑party integrations are stored in cleartext in device configuration. This information‑disclosure vulnerability can enable attackers with access to the appliance to view plaintext credentials. Sev...
Information Disclosure
centreon/centreon is vulnerable to information disclosure. The cleartext passwords of external components are returned in the server response in host configurations, allowing authenticated attackers to gain unauthorized access to external components...
Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal
Overview CERT/CC researchers examined the satcom terminal Cobham EXPLORER 710 as an expansion of work from IOActive’s findings in 2014. They discovered multiple new vulnerabilities affecting the device and the firmware, some of which could allow an unauthenticated, local attacker to gain access t...
CVE-2019-16924
The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers after sniffing the network to take control of the lock...
Default credentials
The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers after sniffing the network to take control of the lock...
CVE-2019-16924
CVE-2019-16924 affects the Nulock mobile app (1.5.0). The vulnerability is that the app sends a cleartext password over Bluetooth , enabling remote attackers (after sniffing the network) to take control of the lock. The connected Red Hat/NVD entries corroborate the same description. No explicit r...
CVE-2019-16924
The Nulock application 1.5.0 for mobile devices sends a cleartext password over Bluetooth, which allows remote attackers after sniffing the network to take control of the lock...
eWON Flexy - Authentication Bypass
!/usr/bin/env python ''' Exploit Title: eWON v13.0 Authentication Bypass Date: 2018-10-12 Exploit Author: Photubias – tijldotDeneutatHowestdotbe for www.ic4.be Vendor Advisory: 1 https://websupport.ewon.biz/support/news/support/ewon-security-enhancement-131s0-0 2...
CVE-2019-14825
A cleartext password storage issue was discovered in Katello. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users...
CVE-2019-15508
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user in certain limited OctopusPrintVariables circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The f...
Cross site request forgery (csrf)
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user in certain limited special-characters circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. T...
Cross site request forgery (csrf)
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user in certain limited OctopusPrintVariables circumstances could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The f...
CVE-2019-15507
Octopus Deploy exposes a vulnerability (CVE-2019-15507) affecting versions 2018.8.4 to 2019.7.6 where, if a web request proxy is configured and the user is authenticated, a deployment could cause the web proxy password to be logged in cleartext. The issue is fixed in 2019.7.7, with back-ports to ...
CVE-2019-5635 Hickory Smart Lock Cleartext Password
A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without using encryption. This exposed the...
CVE-2019-14709
A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...
Default credentials
A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/mipsca.db. If a camera is compromised, the attacker can gain access to passwords and abuse them to compromise further systems...