8967 matches found
CVE-2019-15654
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login...
CVE-2019-15655
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext...
Design/Logic Flaw
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login...
Authentication flaw
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication...
CVE-2019-16067
NETSAS Enigma NMS 65.0.0 and earlier versions use basic authentication over HTTP to enforce access to the web application. The cleartext authentication traffic can allow an attacker to intercept and steal usernames and passwords. The connected documents corroborate this entry across multiple sour...
CVE-2019-16067
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication...
PT-2020-4210 · D Link · D-Link Dsl-2875Al
Name of the Vulnerable Software and Affected Versions: D-Link DSL-2875AL versions 1.00.05 and earlier Description: The issue is related to insufficient protection of registration data, allowing an attacker to gain unauthorized access to protected information using a specially crafted request to t...
PT-2020-9752 · Comba · Comba Ac2400
Name of the Vulnerable Software and Affected Versions: Comba AC2400 devices affected versions not specified Description: The issue allows for password disclosure through a crafted request to the "/09/business/upgrade/upcfgAction.php?download=true" API endpoint. This request does not require...
mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure.
A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive...
CVE-2019-10682
django-nopassword before 5.0.0 stores cleartext secrets in the database...
CVE-2019-10682
django-nopassword before 5.0.0 stores cleartext secrets in the database...
PYSEC-2020-229
django-nopassword before 5.0.0 stores cleartext secrets in the database...
PYSEC-2020-229
django-nopassword before 5.0.0 stores cleartext secrets in the database...
CVE-2019-10682
django-nopassword before 5.0.0 stores cleartext secrets in the database...
CVE-2019-10682
CVE-2019-10682 affects django-nopassword prior to 5.0.0, where cleartext secrets are stored in the database. The connected documents confirm this behavior but do not provide exploit details or remediation steps. The material indicates the impact is sensitive information disclosure due to the plai...
Authentication flaw
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol SMTP account data is saved in RSLogix 500, a local attacker with access to a...
CVE-2020-6980
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol SMTP account data is saved in RSLogix 500, a local attacker with access to a...
CVE-2019-13394
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP...