590 matches found
CVE-2022-1257
CVE-2022-1257 PoC: Извлечение учетных данных из базы данных McAfee Agent Создано scottk817 Этот скрипт является PoC для CVE-2022-1257 , уязвимости в McAfee Agent Trellix Agent при работе с его базой данных. Уязвимость позволяет злоумышленникам извлекать и расшифровывать учетные данные из файла ба...
Damn-Vulnerable-Bank
Damn Vulnerable Bank Guide: https://rewanthtammana.com/damn-vulnerable-bank/ О приложении Damn Vulnerable Bank — это намеренно уязвимое Android-приложение. Все подробности документированы в руководстве, здесь. Предстоящие сессии NoNameCon https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/ Black Hat...
CVE-2022-35513
blink1-pass-decrypt ⭐ poc и простой скрипт, предназначенные для расшифровки шифротекста, находящегося по адресу /blink/input api-сервера в установках blink1control2 версии =2.2.7. эксплойт - CVE-2022-35513 ❗ приложение blink1control2 использует слабое шифрование паролей и небезопасный метод...
CVE-2024-41290
CVE-2024-41290 Обнаружено, что FlatPress CMS v1.3.1 1.3 использует небезопасные методы хранения данных аутентификации Дополнительная информация: FlatPress CMS версии 1.3.1 небезопасно хранит данные, связанные с аутентификацией, включая имена пользователей и хешированные пароли, непосредственно в...
CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...
CVE-2026-77875
Hide Photos – Secure vault (version 4.1.0 ) stores vault media and wallet records in shared external storage , where the data is not bound to the application's calculator-style passcode authentication boundary. A local actor with access to shared external storage—such as through an authorized non...
CVE-2021-38489
HDD password plaintext is stored in a UEFI variable...
CVE-2026-81683
CVE-2026-81683 affects the openssl_encrypt Python package (pip name openssl-encrypt) versions 1.4.8 and earlier . The vulnerability is in the desktop GUI's Settings screen, where a "combined certificate and private key" PEM field stores an mTLS client private key in cleartext within a world-reada...
EUVD-2026-67039
opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...
CVE-2026-75918
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...
CVE-2026-20705
Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...
EUVD-2026-56471
Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...
CVE-2026-20705
Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...
CVE-2026-46513
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...
CVE-2026-14867
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...
CVE-2026-14867 Insecure password storage in User directory
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...
CVE-2026-7257
UNSUPPORTED WHEN ASSIGNED An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00ABDV.3C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file...
CVE-2025-32751
Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...
CVE-2025-32746
Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...