Wago IO 750-849 & 750-881 Weak Credential Management (CVE-2015-6472)

WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. C Tenable, Inc. include'compat.inc'; if description scriptid500680;...

BD Pyxis

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Becton, Dickinson and Company BD Equipment: Pyxis Vulnerability: Not Using Password Aging 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain access to...

Unspecified Vulnerability in Apache NiFi (CNVD-2022-33109)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. A security vulnerability exists in Apache NiFi that stems from the fact that when creating or updating credentials...

CVE-2022-26850 Insufficiently protected credentials

When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the...

ConsoleMe 格式化字符串错误漏洞

ConsoleMe is a web service that makes AWS IAM rights and credential management easier for end users and cloud administrators. A security vulnerability exists in ConsoleMe versions prior to 1.2.2 that stems from a Python format string issue...

What's New in InsightVM and Nexpose: Q4 2021 in Review

Greetings, fellow security professionals. As we enter into the new year, we wanted to provide a recap of product releases and features on the vulnerability management VM front for Q4 2021. Let's start by talking about the elephant in the room. The end of last year was dominated by Log4Shell, the...

CISA Releases Guidance on Protecting Organization-Run Social Media Accounts

CISA has released Capacity Enhancement Guide CEG: Social Media Account Protection, which details ways to protect the security of organization-run social media accounts. Malicious cyber actors that successfully compromise social media accounts—including accounts used by federal agencies—could spre...

Passwordless Network Scanning: Same Insights, Less Risk

Password-based credentials are a ubiquitous part of our online lives, but they are prone to vulnerabilities. Combatting those vulnerabilities has been a major hurdle for security professionals, and it's come at major cost for businesses. We are reinventing the credentialing process for our Networ...

CVE-2021-22351

There is a Credentials Management Errors Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may induce users to grant permissions on modifying items in the configuration table,causing system exceptions...

Huawei Smartphone 安全漏洞

Huawei Smartphone is a smartphone from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS that originates from a credential management error. The vulnerability may affect service confidentiality...

Huawei EMUI/Magic UI Credential Management Error Vulnerability

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI is vulnerable to a credential management error, which can be exploited by attackers to compromise data confidentiality...

华为智能手机授权问题漏洞

Huawei Emui is an Android-based mobile operating system. Huawei Magic UI is the operating system for Honor phones. Huawei EMUI/Magic UI is vulnerable to a credential management error, which can be exploited by attackers to compromise data confidentiality...

Barco ClickShare Button R9861500D01 Credential Management Error Vulnerability

The Barco ClickShare Button R9861500D01 is a wireless control device for presentation systems from Barco Belgium. A credential management error vulnerability exists in Barco ClickShare Button R9861500D01 versions prior to 1.9.0, which can be exploited by an attacker to forge arbitrary software...

Adive Framework 2.0.7 - Privilege Escalation Exploit

Exploit for php platform in category web applications Exploit Title: Adive Framework 2.0.7 - Privilege Escalation Exploit Author: Pablo Santiago Vendor Homepage: https://www.adive.es/ Software Link: https://github.com/ferdinandmartin/adive-php7 Version: 2.0.7 Tested on: Windows 10 CVE :...

CVE-2019-10461

The CVE-2019-10461 entry concerns the Jenkins Dynatrace Application Monitoring Plugin (versions 2.1.3 and earlier). The root cause is that credentials are stored unencrypted in the plugin’s global configuration file on the Jenkins master, allowing any user with access to the master filesystem to ...

CyberArk Enterprise Password Vault 10.7 - XML External Entity Injection Vulnerability

Exploit for multiple platform in category web applications Exploit Title: CyberArk XML External Entity XXE Injection in SAML authentication Exploit Author: Marcelo Toran @spamv Vendor Homepage: https://www.cyberark.com Version: =10.7 CVE : CVE-2019-7442 -----------Product description The CyberArk...

Siemens LOGO!8 BM Devices < 1.81.2 Insufficiently Protected Credentials

Binary data 720103.prm...

CVE-2019-1714

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

CVE-2019-1714

CVE-2019-1714 affects Cisco ASA and Cisco Firepower Threat Defense (FTD) software, where the SAML 2.0 SSO implementation has improper credential handling for NTLM or basic authentication. An unauthenticated, remote attacker could open a VPN session after another user has authenticated via SAML SS...

CVE-2019-3711 DSA-2019-038: RSA® Authentication Manager Insecure Credential Management Vulnerability

RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks...