2070 matches found
CVE-2016-6599
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service ConfigurationService on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the...
Unencrypted Password Store
build-publisher stores passwords unencrypted. Anyone with access to the local file system can access credentials to other Jenkins systems. The credentials are also transmitted in plaintext which exposes them to various other attacks...
SMTP credential vulnerability in multiple HP products
HP DesignJet T790 and others are printer devices from Hewlett-Packard HP in the United States. An SMTP credential vulnerability exists in several HP products. An attacker can exploit this vulnerability to obtain credentials for an SMTP server...
CVE-2017-2747
HP has identified a potential security vulnerability before IG110000.10 for DesignJet T790, T795, T1300, T2300, before MRY040500.5 for DesignJet T920, T930, T1500, T1530, T2500, T2530, before AENEAS030400.9 for DesignJet T3500, before NEXUS011200.11 for Latex 310, 330, 360, 370, before...
CVE-2018-5761
A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user credentials configured to access vCenter as Rubrik clusters did not verify TLS certificates presented by vCenter...
CVE-2014-4991
1 lib/dataset/database/mysql.rb and 2 lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...
Command injection
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process...
CVE-2014-4997
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
CVE-2017-17974
BA SYSTEMS BAS Web on BAS920 devices with Firmware 01.01.00, HTTPserv 00002, and Script 02. and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/getsidjs.aspx or isc/getsid.aspx, as demonstrated by obtaining administrative access by subsequently using...
ABB Ellipse information leakage hole reveals vulnerabilities
Ellipse is an EAM software application for asset-intensive industries. ABB Ellipse is vulnerable to an information leakage hole disclosure vulnerability that allows an attacker to discover authentication credentials by sniffing local network traffic when authenticating Ellipse to LDAP/AD using th...
CVE-2017-3192
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The toolsadmin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page potentially through a...
CVE-2017-3185
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...
GHSA-FQRR-RRWG-69PV Local API Login Credentials Disclosure in paratrooper-pingdom
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. Vulnerable Code: From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb ruby def setupoptions = %xcurl https://api.pingdom.com/api/2.0/checks -X PUT ...
Multiple ZTE Products Information Disclosure Vulnerability
ZTE OX-330P and others are wireless router products from ZTE Corporation ZTE of China. An information disclosure vulnerability exists in multiple ZTE products. A remote attacker could exploit this vulnerability to obtain credentials or other sensitive information...
IBM BigFix Compliance Analytics Information Disclosure Vulnerability
IBM BigFix Compliance Analytics TEMA SUAv1 SCA SCM is a suite of systems management software from IBM in the United States. The software provides remote control, patch management, software distribution, operating system deployment, network access protection and other functions. A security...
CVE-2017-1429
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127587...
Lenovo XClarity Administrator (LXCA) Information Disclosure Vulnerability
Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China, designed to reduce complexity, accelerate responsiveness, and increase the availability of Lenovo server systems and solutions. A security vulnerability exists in Lenovo LXCA. The vulnerability ca...
CVE-2017-1447
IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128172...
CVE-2017-1495
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information including access credentials. IBM X-Force ID: 128693...