CVE-2014-3093

IBM PowerVC versions 1.2.0 before FP3 and 1.2.1 before FP2 are affected. The issue involves cleartext passwords being stored/accessed in multiple locations (api-paste.ini, debug logs, installation process, environment checks, powervc-ldap-config, powervc-restore, powervc-diag), allowing local use...

CVE-2014-4806

The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive informati...

CVE-2014-3093

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

Default credentials

The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive informati...

Command injection

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

CVE-2014-3089

The RDS Java Client library in IBM Rational Directory Server RDS 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator RDA 6.0 before iFix002, includes the cleartext root password, which allows local users to obtain sensitive information by reading a...

Design/Logic Flaw

The RDS Java Client library in IBM Rational Directory Server RDS 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator RDA 6.0 before iFix002, includes the cleartext root password, which allows local users to obtain sensitive information by reading a...

CVE-2014-3089

The RDS Java Client library in IBM Rational Directory Server RDS 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator RDA 6.0 before iFix002, includes the cleartext root password, which allows local users to obtain sensitive information by reading a...

CVE-2014-1469

BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file...

Design/Logic Flaw

BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file...

CVE-2014-1469

BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file...

WordPress 3.7.1 & 3.8 - Cleartext Admin Credentials Disclosure

...

D-Link AP 3200 Missing Authentication / Cleartext Secret Storage

Exploit Title: D-Link AP 3200 Multiple Vulnerabilities Date: 29/07/2014 Exploit Author: pws Vendor Homepage: http://www.dlink.com/ Firmware Link: http://ftp.dlink.ru/pub/Wireless/DWL-3200AP/Firmware/ Tested on: Latest version Shodan d0rk: "Server: Allegro-Software-RomPager/4.06" 12000 devices CVE...

CVE-2014-0103

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files...

Information disclosure

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files...

CVE-2014-0103

CVE-2014-0103 affects Zarafa WebAccess (and WebApp) prior to version 7.1.10 / 1.6, where credentials are stored in cleartext in PHP session files. This enables local Apache users to read sensitive information. OpenVAS advisories link CVE-2014-0103 to multiple Zarafa updates; Fedora/MGASA advisori...

CVE-2014-0103

WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files...

CVE-2014-0035

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing th...

CVE-2014-0869

The decrypt function in RICOS in IBM Algo Credit Limits aka ACLM 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string argument to this functi...

CVE-2014-0860

The firmware before 3.66E in IBM BladeCenter Advanced Management Module AMM, the firmware before 1.43 in IBM Integrated Management Module IMM, and the firmware before 4.15 in IBM Integrated Management Module II IMM2 contains cleartext IPMI credentials, which allows attackers to execute arbitrary...