PT-2019-1181

Name of the Vulnerable Software and Affected Versions Juniper ATP Series versions prior to 5.0.3 Description The issue is related to the storage of credentials in a file that can be accessed by authenticated local users, potentially allowing an attacker to access the Splunk server. This could...

CVE-2018-16223

Insecure Cryptographic Storage of credentials in com.vestiacom.qbeecamerapreferences.xml in the QBee Cam application through 1.0.5 for Android allows an attacker to retrieve the username and password...

CVE-2018-16222

The CVE-2018-16222 entry affects the iSmartAlarm Android app (up to version 2.0.8). The issue is cleartext storage of credentials in the iSmartAlarmData.xml configuration file, which can allow an attacker to retrieve the username and password. The connected documents confirm affected product comp...

CVE-2018-13822

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

CVE-2018-13822

CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below are affected by CVE-2018-13822 due to unprotected storage of credentials. This allows attackers to access sensitive information. The Connected documents confirm the affected versions and the credential storage issue; no...

PT-2018-12206

Name of the Vulnerable Software and Affected Versions CA PPM versions 14.3 and below CA PPM version 14.4 CA PPM versions 15.1 through 15.2 CP5 and below CA PPM versions 15.3 through 15.3 CP2 and below Description The issue concerns the unprotected storage of credentials, which could allow attacke...

CVE-2018-13822: Insufficiently Protected Credentials

Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information...

ABB IP Gateway

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: IP Gateway Vulnerabilities: Improper Authentication, Cross-site Request Forgery, Unprotected Storage of Credentials 2. RISK EVALUATION Successful exploitation of these...

Lenovo Fingerprint Manager Pro for Windows 7, 8, and 8.1 only (not 10) Insecure Credential Storage - US

Lenovo Security Advisory: LEN-15999 Potential Impact: Local Privilege Escalation Severity: High Scope of Impact: Lenovo Specific CVE Identifier: CVE-2017-3762 Summary Description: A vulnerability has been identified in Lenovo Fingerprint Manager Pro. Sensitive data stored by Lenovo Fingerprint...

CVE-2017-1701

IBM Team Concert RTC 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption algorithm, which could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 134393...

PT-2018-6384

Name of the Vulnerable Software and Affected Versions: IBM Team Concert RTC versions 5.0 through 6.0.5 Description: The issue allows an authenticated user to obtain highly sensitive information due to the use of a weak encryption algorithm for storing user credentials. Recommendations: For versio...

IBM Rational DOORS Web Access Credential Storage Vulnerability

IBM Rational DOORS is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM in the United States. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...

CVE-2017-1000387

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

Mikogo 5.4.1.160608 Local Credentials Disclosure

Description Mikogo is vulnerable to local credentials disclosure, the supplied password is stored as a MD5 hash format in memory process. A potential attacker could reveal the supplied password hash and re-use it or store it via the configuration file in order to gain access to the account...

CVE-2017-4966

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-...

CVE-2017-5230

The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk...

PT-2017-8888

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 2.0.1, 2.5, and 2.6 Description The issue concerns the storage of user credentials in plain text, allowing a local user to read them. Recommendations For IBM Tivoli Key Lifecycle Manager version 2.0.1,...

Sauter moduWeb Vision Vulnerabilities

OVERVIEW Martin Jartelius and John Stock of Outpost24 have identified three vulnerabilities in Sauter’s moduWeb Vision application. Sauter has produced a new firmware version to mitigate these vulnerabilities. The researchers have tested the new firmware version to validate that it resolves the...

TeamViewer 11.0.65452 (64bit) Credential Disclosure

TeamViewer 11.0.65452 64 bit Local Credentials Disclosure Tested on Windows 7 64bit, English Vendor Homepage @ https://www.teamviewer.com/ Date 07/09/2016 Bug Discovered by Alexander Korznikov https://www.linkedin.com/in/nopernik http://www.korznikov.com | @nopernik Special Thanks to: Viktor Mini...

Google Chrome memory misreference vulnerability (CNVD-2016-05593)

Google Chrome is a web browsing tool developed by Google. A memory misreference vulnerability exists in the handling of source information in proxy authentication in versions prior to Google Chrome 52.0.2743.82. A man-in-the-middle attacker modifying the client-to-server data flow can spoof the...