CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

Default credentials

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

CVE-2018-7581 concerns WebLog Expert Web Server Enterprise 9.4. The vulnerability stems from weak file permissions on the WebServer.cfg in ProgramData\WebLog Expert\WebServer, allowing a local user to set a plaintext password and log in as admin (authentication bypass). Affected product is WebLog...

WebLog Expert Web Server Enterprise 9.4 Weak Permissions Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ======== www.weblogexpert.com Product: ======== WebLog Expert Web Server Enterprise v9.4 WebLog Expert is a fast and powerful access log analyzer. It will give you information about your site's...

WebLog Expert Web Server Enterprise 9.4 Weak Permissions

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-AUTHENTICATION-BYPASS.txt + ISR: Apparition Security Vendor: ======== www.weblogexpert.com Product: ======== WebLog Expert Web Server...

Default credentials

The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application sets the encrypt flag with the password "ITsILLEGAL"; however, this password is not required to extract the data. Cleartext is used for a...

CVE-2017-15272

The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application sets the encrypt flag with the password "ITsILLEGAL"; however, this password is not required to extract the data. Cleartext is used for a...

CVE-2013-3734

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...

Input validation

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...

CVE-2013-3734

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...

CVE-2013-3734

The CVE-2013-3734 vulnerability affects the Embedded Jopr component of JBoss Application Server, where the cleartext datasource password is included in unspecified HTML responses. Root cause: passwords are exposed in later responses (even if masked in the UI) or in the HTML source, enabling infor...

ProMinent MultiFLEX M10a Controller Password Disclosure Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A password disclosure vulnerability exists in the ProMinent MultiFLEX M10a Controller, where an authenticated user using the "Change Password" feature in the application specifies the user's current password in cleartext, allowing an...

JasperSoft JasperReports 4.7 Password Disclosure

Credits: Joshua Platz aka Binary1985 + CVE ID: CVE-2017-14941 + Website: https://github.com/binary1985 + Source: https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/JasperSoft%20JasperReports%20-%204.7%20-%20CVE-2017-14941 Vendor: ==========================...

CVE-2017-14418

The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B with firmware through FW208WWb02 devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services...

PT-2017-13462 · D Link · Mydlink Cloud Services +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. B versions through FW208WWb02 Description: The issue concerns the transmission of the admin password in cleartext over the Internet when the D-Link NPAPI extension interacts with mydlink Cloud Services. Recommendations: F...

GoAutoDial 3.3 Authentication Bypass / Command Injection Exploit

This Metasploit module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database...

Default credentials

rhscon-ceph in Red Hat Storage Console 2 x8664 and Red Hat Storage Console Node 2 x8664 allows local users to obtain the password as cleartext...

CVE-2016-7062

CVE-2016-7062 describes an information-disclosure flaw in Red Hat Storage Console 2 (x86_64) affecting rhscon-ceph and rhscon-core communication. An authenticated, local attacker could recover the cleartext password by exploiting how authentication details are passed between these components. The...