CVE-2024-47295

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under...

Panasonic WV-S2231L Camera Use of Hard-coded Credentials (CVE-2020-29193)

Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa which is just the asdf keyboard row in reverse order. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2024-6125 Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism

The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for...

CGA-P84W-8XXG-7C4W

Bulletin has no description...

PT-2024-58: Insecure password storage in Yealink Meeting Server (YMS)

The vulnerability was identified in Yealink Meeting Server YMS, versions V26.0.0.67. The discovered vulnerability allows an attacker to obtain static key data, allowing user passwords to be decrypted. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 06.06.2024...

RHEL 6 : xguest (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - xguest insecure password creation CVE-2016-4980 Note that Nessus has not tested for this issue but has instead reli...

SUSE CVE-2017-15112

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

CVE-2023-37503

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts...

CVE-2023-37503

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts...

Default credentials

HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts...

CVE-2023-37503

Summary: CVE-2023-37503 affects HCL Compass and describes weak/insecure password requirements that could allow unauthorized access to user accounts. The connected documents consistently reference HCL Compass and the risk of easily guessing passwords, but do not provide concrete attacker vectors, ...

HCL Technologies Compass 安全漏洞

HCL Technologies Compass is a low-code change management software from HCL Technologies, USA. Manages the full range of testing activities and integration with developer tools. HCL Technologies Compass suffers from a weak password vulnerability that stems from susceptibility to insecure password...

CVE-2023-27877

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905...

CVE-2023-27877

CVE-2023-27877 affects IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.0. The issue arises from an insecure CouchDB password policy over the network, allowing an attacker to disclose sensitive data stored in CouchDB. Documents consistently identify the affected component as the Cart...

Kiddoware Kids Place Parental Control Android App 3.8.49 XSS / CSRF / File Upload

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Kiddoware Kids Place Parental Control Android App vulnerable version: =3.8.49 fixed version: 3.8.50 or higher CVE number: CVE-2023-28153...

Able to change admin email and password without current password validation.

Description Able to change admin email and password without current password validation. Change the User%5Buid%5D for the User UID of the current admin user. for the example: uid of the current admin is 1. Then change the other info like User%5Bemail%5D,User%5Bpassword%5D and passwordrepeat for...

CVE-2022-45635

An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy...

CVE-2022-45637

An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechanism...

Information disclosure

An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy...

CVE-2022-45637

CVE-2022-45637 concerns MEGAFEIS/BOFEI DBD+ mobile app (iOS & Android) v1.4.4 with an insecure password reset code expiry mechanism. Multiple connected sources (NVD, Red Hat, CVE list, PRION, and WithSecure PoC repo) describe the vulnerability as an insecure expiry mechanism for password reset, e...