General Motors and Shanghai OnStar (SOS) iOS Client

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: General Motors GM, Shanghai OnStar SOS Equipment: SOS iOS Client Vulnerabilities: Cleartext Storage of Sensitive Information, Man-in-the-Middle, Improper Authentication REPOSTED INFORMATION This advisory was originall...

ICSMA-17-229-01_Philips' DoseWise Portal Vulnerabilities

OVERVIEW Philips has identified Hard-coded Credentials and Cleartext Storage of Sensitive Information vulnerabilities in Philips’ DoseWise Portal DWP web application. Philips has updated product documentation and produced a new version that mitigates these vulnerabilities. These vulnerabilities...

FortiWeb SNMPv3 user password viewable in HTML source code

The HTML source code of the FortiWeb SNMPv3 user edit webui page includes the user's password in cleartext...

Information disclosure

An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...

CVE-2017-7737

An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...

SMA Solar Technology inverter weak password vulnerability (CNVD-2017-27847)

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A security vulnerability exists in the SMA Solar Technology inverter, which arises from the program's use of a simple encryption algorithm to encrypt passwords, which can be exploited by an attacker to obtain...

Televes COAXDATA GATEWAY 1Gbps Device Backup File Disclosure Vulnerability

The Televes COAXDATA GATEWAY 1Gbps devices is a wireless router device from the Spanish company Televes. A security vulnerability exists in the Televes COAXDATA GATEWAY 1Gbps devices. An attacker could exploit the vulnerability to access a backup file containing a certificate in clear text...

CVE-2017-6532

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 have cleartext credentials in /mib.db...

CVE-2017-6532

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 have cleartext credentials in /mib.db...

Design/Logic Flaw

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 have cleartext credentials in /mib.db...

CVE-2017-6532

CVE-2017-6532 affects Televes COAXDATA GATEWAY 1Gbps devices (documented as Televes COAXDATA GATEWAY 1Gbps devices with firmware/build references). The vulnerability is described as cleartext credentials stored in /mib.db. CNVD-2017-18523 additionally notes a backup file disclosure that could exp...

CVE-2017-6532

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgwv1.02.0014 4.20 have cleartext credentials in /mib.db...

IBM WebSphere MQ 9.0.1 < 9.0.3 Multiple Vulnerabilities

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is 9.0.1 or 9.0.2 prior to 9.0.3. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the insecure transmission of credentials in...

Samba 4.4.x < 4.4.15 / 4.5.x < 4.5.12 / 4.6.x < 4.6.6 KDC-REP Service Name Validation (Orpheus' Lyre)

The version of Samba running on the remote host is 4.4.x prior to 4.4.15, 4.5.x prior to 4.5.12, or 4.6.x prior to 4.6.6. It is, therefore, affected by a logic flaw in the Heimdal implementation of Kerberos, specifically within the krb5extractticket function within lib/krb5/ticket.c, due to the...

R7-2017-02: Hyundai Blue Link Potential Info Disclosure (FIXED)

Summary Due to a reliance on cleartext communications and the use of a hard-coded decryption password, two outdated versions of Hyundai Blue Link application software, 3.9.4 and 3.9.5 potentially expose sensitive information about registered users and their vehicles, including application...

CVE-2017-7729

On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext...

Design/Logic Flaw

On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext...

CVE-2017-7729

CVE-2017-7729 concerns iSmartAlarm cube devices, where an incorrect access control vulnerability arises because a newly created key is transmitted in cleartext. The issue is documented with a network-attack surface and low attack complexity, resulting in a high impact on integrity (partial) per C...

CVE-2017-7729

On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext...

HP SiteScope Multiple Vulnerabilities (HPESBGN03763)

The version of HP SiteScope running on the remote host is 11.2x or 11.3x. It is, therefore, affected by multiple vulnerabilities : - A cryptographic weakness exists in the sspu.jar library due to the use of hard-coded encryption keys. A local attacker can exploit this to disclose potentially...