Mail.ru: Insecure Storage and Overly Permissive Google Maps API Key in Android App

Google API keys used in Cloud Mail.Ru for Android application were not properly limited in functionality...

PHOENIX CONTACT FL SWITCH

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: FL SWITCH Vulnerabilities: Cross-site Request Forgery, Improper Restriction of Excessive Authentication Attempts, Cleartext Transmission of Sensitive Information, Resourc...

CVE-2016-4644

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials...

GitLab CE/EE Sensitive Information Plaintext Storage Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A sensitive informati...

PT-2018-13440

Name of the Vulnerable Software and Affected Versions QBee Cam application version 1.0.5 and earlier Description The issue concerns insecure storage of credentials in the com.vestiacom.qbeecamera preferences.xml file, allowing an attacker to retrieve the username and password. Recommendations For...

CVE-2018-15123

Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home...

CVE-2018-11544

The Olive Tree Ftp Server application 1.32 for Android has Insecure Data Storage because a username and password are stored in the /data/data/com.theolivetree.ftpserver/sharedprefs/com.theolivetree.ftpserverpreferences.xml file as the prefUsername and prefUserpass strings...

BeaconMedaes Scroll Medical Air Systems TotalAlert Web Application Information Disclosure Vulnerability (CNVD-2018-10605)

BeaconMedaes Scroll Medical Air Systems is a medical surgical air system from BeaconMedaes, Inc. and TotalAlert Web Application is a web-based management program. A security vulnerability exists in the TotalAlert Web Application in the BeaconMedaes Scroll Medical Air Systems. An attacker could...

CVE-2018-7518: Insufficiently Protected Credentials

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner...

CVE-2017-5249

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5250

In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5249

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

PT-2018-8243

Name of the Vulnerable Software and Affected Versions: Insteon for Hub Android app versions 1.9.7 and prior Description: The issue concerns the insecure storage of the OAuth token used for authorizing user access. This token is not stored in an encrypted and secure manner, potentially exposing us...

CVE-2017-5249: Insecure Storage of Sensitive Information

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5250: Insecure Storage of Sensitive Information

In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

Wickr Inc - App Clock & Message Deletion Glitch P2

Document Title: =============== Wickr Inc - App Clock & Message Deletion Glitch P2 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2107 Document: https://www.vulnerability-lab.com/resources/documents/2107.rar Vulnerability Magazine:...

Wickr Inc - App Clock & Message Deletion Glitch P2

Document Title: =============== Wickr Inc - App Clock & Message Deletion Glitch P2 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2107 Document: https://www.vulnerability-lab.com/resources/documents/2107.rar Vulnerability Magazine:...

CVE-2017-13701

Affected product: MOXA EDS-G512E (5.1 build 16072215). Issue: backup files store passwords without salt and with an insecure, timestamped ciphering method, enabling exposure of credentials. Impact: high confidentiality and integrity concerns; CVSS-3.0 base score 9.8 (CRITICAL), network attack vec...

PT-2017-13030

Name of the Vulnerable Software and Affected Versions MOXA EDS-G512E version 5.1 build 16072215 Description The issue concerns the insecure storage of sensitive information in the backup file of the affected device. Specifically, passwords are stored without being hashed with a salt, and they are...

CVE-2017-16560: Insecure Storage of Sensitive Information

SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the application crashes...