The vulnerability of the quality management software for automobile manufacturers, QMS Automotive, arises from the fact that confidential information is stored in unencrypted form in memory, allowing a hacker to obtain user account details.

The vulnerability of the quality management software for automobile manufacturers, QMS Automotive, relates to the storage of confidential information in unencrypted form in memory. Exploiting this vulnerability could allow a malicious actor to access user credentials remotely...

PT-2023-31387 · Unknown · Didi Knowsearch

Name of the Vulnerable Software and Affected Versions: didi KnowSearch versions 0.3.1.2 through 0.3.2 Description: A vulnerability was found in didi KnowSearch, affecting some unknown processing of the file "/api/es/admin/v3/security/user/1". This issue leads to unprotected storage of credentials...

CVE-2023-33263

In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006...

WFTPD 安全漏洞

WFTPD is an FTP service. A security vulnerability exists in WFTPD version 3.25 that stems from username and password hashes stored in a publicly viewable wftpd.ini configuration file in the WFTPD directory...

PT-2023-3900 · Amazon · Aws-Sigv4

Name of the Vulnerable Software and Affected Versions: aws-sigv4 versions prior to 0.55.1 aws-sigv4 version 0.54.2 aws-sigv4 version 0.53.2 aws-sigv4 version 0.52.1 aws-sigv4 version 0.51.1 aws-sigv4 version 0.50.1 aws-sigv4 version 0.49.1 aws-sigv4 version 0.48.1 aws-sigv4 version 0.47.1 aws-sig...

PT-2023-22743 · Jenkins · Jenkins Azure Key Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure Key Vault Plugin versions 187.va cd5fecd198a and earlier Description: The issue arises when the push mode for durable task logging is enabled, causing the plugin to not properly mask credentials in the build log. This means that...

Design/Logic Flaw

Sunell DVR, latest version, Insufficiently Protected Credentials CWE-522 may be exposed through an unspecified request...

SUSE CVE-2017-0882

Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC...

SUSE CVE-2020-10755

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

ArgoCD 日志信息泄露漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...

PT-2023-2478 · Aten · Aten Pe8108

Name of the Vulnerable Software and Affected Versions: Aten PE8108 version 2.4.232 Description: The issue is related to insufficient protection of registration data in the web interface of the Aten PE8108 power distribution unit PDU software. This allows for unauthenticated access to Telnet and...

CVE-2022-46685

In Jenkins Gitea Plugin, versions 1.4.4 and earlier did not mask Gitea personal access tokens, potentially exposing credentials in build logs. The issue is documented across multiple feeds (NVD, Red Hat, OSV, GHSA) with the same root cause and scope: credentials masking was not supported, enablin...

CVE-2022-36307

The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models...

Airspan AirVelocity 1500 安全漏洞

The Airspan AirVelocity 1500 is a revolutionary indoor high-performance small cell from Airspan USA. Designed to bring public access LTE networks to indoor spaces A security vulnerability exists in the Airspan AirVelocity 1500 that originates from the ability to print SNMP credentials via a...

CVE-2022-29090

Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vulnerability in order to obtain credentials. The attacker may be able to use the exposed credentials to access the target device and perform...

CVE-2022-34046

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

CVE-2022-1524

LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials...

CVE-2021-42886

TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file...

CVE-2021-42886

TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file...

Vulnerability fixed in IBM Spectrum Protect Plus

IBM has fixed a vulnerability in Spectrum Protect Plus. Credentials of users are printed in readable text in the IBM Spectrum Protect Plus virgo log file. IBM has released updates to fix the vulnerabilities in Spectrum Protect Plus 10.1.0.0-10.1.9.32. For more information, see:...