CVE-2018-20382

Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-20388

Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-20382

Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests...

CVE-2018-20400

CVE-2018-20400 affects Ubee DVW2108 (6.28.1017) and DVW2110 (6.28.2012) devices. The issue allows remote attackers to discover credentials by sending SNMP requests to iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0. The vulnerability is triggered via SNMP and results in ...

D-Link DSL-2770L Credential Disclosure

Vendor us.dlink.com Product D-Link DSL-2770L version ME1.01, ME1.02, AU1.06 Vulnerability Type admin credentials disclosure Affected Component Web Interface CVE Reference CVE-2018-18007 Security Issue An authenticated user can visit the page atbox.htm, for example, http://victimeip/atbox.htm, and...

D-Link DSL-2770L / DIR-140L / DIR-640L Credential Disclosure

Vendor us.dlink.com Product D-Link DSL-2770L version ME1.01, ME1.02, AU1.06 D-Link DIR-140L, DIR-640L version 1.00, 1.01RU, 1.02 D-Link DWR-116, DWR-512, DWR-555, DWR-921 version V1.03, V1.05, V2.01, V2.02 Vulnerability Type admin credentials disclosure Affected Component Web Interface CVE...

The vulnerability of the IBM WebSphere Portal software arises from the lack of measures taken to protect the structure of the web page. This allows attackers to disclose user credentials during a secure session.

The vulnerability of the IBM WebSphere Portal software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials during a secure session, thereby allowing the insertion of arbitra...

CVE-2018-1889

IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080...

CVE-2018-1891

IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152082...

IBM Security Access Manager Cross-Site Scripting Vulnerability (CNVD-2018-26357)

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. A cross-site scripting vulnerability exists in IBM Security Access Manager version...

CVE-2018-1667

IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2018-1740

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2018-1871

CVE-2018-1871 is an XSS vulnerability in IBM Financial Transaction Manager family (Multi-Platform) affecting several 3.x line components. Affected are IBM FTM for Digital Payments on Multi-Platform versions 3.0.0.0, 3.0.2, and 3.0.5, with potential to embed arbitrary JavaScript in the Web UI and ...

CVE-2018-1762

IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

CVE-2018-18865

The Royal browser extensions TS before 4.3.60728 Release Date 2018-07-28 and TSX before 3.3.1 Release Date 2018-09-13 allow Credentials Disclosure...

CVE-2018-1798

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Royal TS/X Information Disclosure Vulnerability

Royal TS/X is a standard terminal services management tool that supports remote management and control on the macOS platform. An information disclosure vulnerability exists in Royal TS versions prior to 4.3.60728 released 2018-07-28 and TSX versions prior to 3.3.1 released 2018-09-13, which stems...

QBee Camera / iSmartAlarm Credential Disclosure Vulnerability

Cleartext storage of credentials in the iSmartAlermData.xml configuration file in the iSmartAlarm application through 2.0.8 for Android allows an attacker to retrieve the username and password. Insecure cryptographic storage of credentials in com.vestiacom.qbeecamerapreferences.xml in the QBee Ca...

CVE-2017-1609

IBM Rational Quality Manager (RQM) versions 5.0–5.0.2 and 6.0–6.0.6 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products/versions: Rational Quality Ma...

Advantech WebAccess Bwmainleft.asp Page Cross-Site Scripting Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A cross-site scripting vulnerability exists in the...