MikroTik WinBox Information Disclosure Vulnerability

MikroTik WinBox is a utility program for managing MikroTik RouterOS systems from MikroTik Latvia. A security vulnerability exists in MikroTik WinBox version 3.22 and earlier, which stems from the program storing user plaintext passwords in the settings.cfg.viw configuration file. An attacker can...

CVE-2020-5721

MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuratio...

Default credentials

MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuratio...

CVE-2020-5721

MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. Keep Password is set by default and, by default Master Password is not set. An attacker with access to the configuratio...

CVE-2020-5721

MikroTik WinBox 3.22 and earlier stores the user’s cleartext password in settings.cfg.viw when Keep Password is enabled and no Master Password is set. By default Keep Password is on and Master Password is not set, so an attacker with access to the configuration file can extract usernames and pass...

Privilege Escalation

kernel is vulnerable to privilege escalation. The vulnerability exists as it was found that the perf tool, a part of the Linux kernel's Performance Events implementation, could load its configuration file from the current working directory. If a local user with access to the perf tool were tricke...

Arbitrary Code Execution

sudo is vulnerable to arbitrary code execution. The RHBA-2010:0212 sudo update released as part of Red Hat Enterprise Linux 5.5 added the ability to change the value of the ignoredot option in the "/etc/sudoers" configuration file. This ability introduced a regression in the upstream fix for...

Privilege Escalation

sudo is vulnerable to privilege escalation. The vulnerability exists as a flaw was discovered in a way sudo handled group specifications in "run as" lists in the sudoers configuration file. If sudo configuration allowed a user to run commands as any user of some group and the user was also a memb...

Design/Logic Flaw

A local, authenticated user with shell can view sensitive configuration information via the ev.ops configuration file. This issue affects all versions of Junos OS Evolved prior to 19.2R1...

Unspecified Vulnerability in NCH Software Express Invoice

NCH Software Express Invoice is an inventory system from NCH Software Australia. The system is mainly used for invoice management, etc. A security vulnerability exists in NCH Software Express Invoice version 7.25, which stems from the program storing passwords in plaintext form. This vulnerabilit...

ZSQL: Default Listening Port

Change the listening port from the default 1611 to another value, protecting the database from malicious clients. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

ZSQL: Maximum Number of Connections

If the maximum number of online connections is set to a large value, the required process socket handles and session pool memory may exceed the OS limit on the server. - Value: The minimum value to be compliant. - Maximum: The maximum value to be compliant. SPDX-FileCopyrightText: 2020 Greenbone ...

CVE-2020-11560

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-11560

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file...

Design/Logic Flaw

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-11560

CVE-2020-11560 affects NCH Express Invoice 7.25. Local users can read the application’s configuration file to obtain cleartext passwords, enabling potential account takeover. Root cause: credentials stored in plaintext in the configuration/files under the Express Invoice data path. Exploitation d...

PT-2020-12693 · Nch · Express Invoice

Name of the Vulnerable Software and Affected Versions: NCH Express Invoice version 7.25 Description: The issue allows local users to discover the cleartext password by reading the configuration file. Recommendations: For version 7.25, consider restricting access to the configuration file to...

CVE-2020-11560

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-11107

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users including admins to enable arbitrary command execution...

CVE-2020-2164

Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...