8915 matches found
CVE-2022-32227
CVE-2022-32227 affects Rocket.Chat prior to v5, v4.8.2, and v4.7.5, where a user with the permission view-full-other-user-info could access another user’s OAuth tokens via the REST API (users.info). The root cause is cleartext transmission/leak of sensitive OAuth token data. Impact described incl...
CVE-2022-32227
A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...
CVE-2022-32227
A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...
PT-2022-21162 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: The issue concerns a cleartext transmission of sensitive information in Rocket.Chat, specifically relating to OAuth tokens...
PT-2022-21156 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 4.6.4 Description: A cleartext storage of sensitive information exists due to an Oauth token being leaked in plaintext in Rocket.Chat logs. Recommendations: For versions prior to 4.6.4, update to version 4.6.4 or...
CVE-2022-41318
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a...
You can’t stop me. MS Teams session hijacking and bypass
How cleartext session tokens are stored in an unsecured directory that can be stolen and used to impersonate a Teams user. TL;DR Microsoft Teams stores unencrypted session tokens and cached conversations in users’ roaming AppData, which can be used by an attacker to gain access to the victim’s...
Trojan-Dropper.Win32.Corty.10 MVID-2022-0639 Insecure Credential Storage
Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Corty.10 Vulnerability: Insecure Credential Storage Description: The...
CVE-2022-38769
The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request...
CVE-2022-38769
The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request...
CVE-2022-38769
The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request...
Cross site request forgery (csrf)
The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request...
CVE-2022-38769
The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request...
CVE-2022-38769
CVE-2022-38769 affects the Transtek Mojodat FAM (Fixed Asset Management) mobile app, version 2.4.6. The issue enables remote attackers to fetch cleartext passwords after a successful login request. Exploitation details in connected sources confirm affected software and the login-data exposure ris...
CVE-2022-39821
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem...
CVE-2022-39821
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem...
CVE-2022-39816
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials cleartext administrator password occur in the edit configuration page. Exploitation requires an authenticated attacker...
CVE-2022-39816
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials cleartext administrator password occur in the edit configuration page. Exploitation requires an authenticated attacker...
CVE-2022-39816
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials cleartext administrator password occur in the edit configuration page. Exploitation requires an authenticated attacker...
Default credentials
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials cleartext administrator password occur in the edit configuration page. Exploitation requires an authenticated attacker...