Multiple Weidmueller Products Information Disclosure Vulnerability (CNVD-2020-01004)

Weidmueller IE-SW-VL05M-5TX and so on are an industrial Ethernet switch from Weidmueller, Germany. An information disclosure vulnerability exists in multiple Weidmueller products that originates from a program passing sensitive credential data in clear text. An attacker could exploit this...

BSD Dump Password Hashes

Post module to dump the password hashes for all users on a BSD system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BSD Dump Password Hashes', 'Description' = %q Post module to dump the...

Code injection

Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker wi...

CVE-2018-19009

Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker wi...

CVE-2018-19009

CVE-2018-19009 affects Pilz PNOZmulti Configurator (all versions prior to 10.9). The vulnerability stems from clear-text storage of credentials, enabling an authenticated local attacker to view sensitive PMI m107 diag HMI credentials and, with physical access, potentially modify data on that HMI....

X (Formerly Twitter): Bypassing Digits bridge origin validation

Hi, I would like to report an issue in the bridge proxy in Digits which allows attacker to retrieve the OAuth credential data of an application victims authorized. Detail In the Digits Web SDK, the method getLoginStatus can be used to retrieve the OAuth credential data of an application if the us...

CVE-2014-0659

The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests...

Alt-N MDaemon < 13.0.4 Multiple Vulnerabilities

The remote Windows host is running a version of Alt-N MDaemon that is earlier than 13.0.4. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Strip X-Headers' setting that could allow the application to crash. Issue 10358 - An input...

Design/Logic Flaw

Google Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs, which allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining credential data, a different vulnerability than CVE-2012-4903...

CVE-2012-4906

Google Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs, which allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining credential data, a different vulnerability than CVE-2012-4903...

CVE-2012-4906

Google Chrome before 18.0.1025308 on Android does not properly restrict access to file: URLs, which allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining credential data, a different vulnerability than CVE-2012-4903...

CVE-2012-4906

Removed by vendor...

Authentication flaw

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication...

PT-2012-5155 · Tridium · Tridium Niagara Ax Framework

Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX Framework affected versions not specified Description: The issue concerns the improper storage of credential data, allowing attackers to bypass access restrictions by using the stored information for authentication...

CVE-2006-6493

Buffer overflow in the krbv4ldapauth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind Kerberos KBIND option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAPAUTHKRBV41 authentication meth...

CVE-2006-4232

Race condition in the grid-proxy-init tool in Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allows local users to steal credential data by replacing the proxy credentials file in between file creation and the check for exclusive file access...

CVE-2006-4232

Race condition in the grid-proxy-init tool in Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allows local users to steal credential data by replacing the proxy credentials file in between file creation and the check for exclusive file access...

CVE-2006-4232

CVE-2006-4232 : A race condition in the grid-proxy-init tool of Globus Toolkit (versions 3.2.x, 4.0.x, 4.1.0 before 20060815) allows local attackers to steal credential data by replacing the proxy credentials file between its creation and the check for exclusive access. The vulnerability arises f...