CVE-2018-9280

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwords of the read and write users could be retrieved by browsing the source code of the webpage...

Security Bulletin: Password disclosure via trace log vulnerability in IBM MQ Managed File Transfer (CVE-2017-1795)

Summary Trace files generated by IBM MQ Managed File Transfer commands display passwords in plain text. Vulnerability Details CVEID: CVE-2017-1795 DESCRIPTION: IBM MQ Managed File Transfer could allow a local user to obtain highly sensitive information via trace log files generated by its command...

Phoenix Contact WebVisit 6.40.00 - Password Disclosure

Exploit Title: Phoenix Contact WebVisit 6.40.00 - Password Disclosure Exploit Author: Deneut Tijl Date: 2018-09-30 Vendor Homepage: www.phoenixcontact.com Software Link: https://www.phoenixcontact.com/online/portal/nl/?uri=pxc-oc-itemdetail:pid=2985725&library=nlnl&pcck=P-19-05-01&tab=5 Version:...

Phoenix Contact WebVisit 6.40.00 Password Disclosure

Exploit Title: Phoenix Contact WebVisit 6.40.00 - Password Disclosure Exploit Author: Deneut Tijl Date: 2018-09-30 Vendor Homepage: www.phoenixcontact.com Software Link: https://www.phoenixcontact.com/online/portal/nl/?uri=pxc-oc-itemdetail:pid=2985725&library=nlnl&pcck=P-19-05-01&tab=5 Version:...

Phoenix Contact WebVisit 6.40.00 - Password Disclosure

Phoenix Contact WebVisit 6.40.00 - Password Disclosure Exploit Title: Phoenix Contact WebVisit 6.40.00 - Password Disclosure Exploit Author: Deneut Tijl Date: 2018-09-30 Vendor Homepage: www.phoenixcontact.com Software Link:...

Phoenix Contact WebVisit 6.40.00 - Password Disclosure Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Phoenix Contact WebVisit 6.40.00 - Password Disclosure Exploit Author: Deneut Tijl Vendor Homepage: www.phoenixcontact.com Software Link:...

PTC ThingWorx Password Disclosure / Cross Site Scripting Vulnerabilities

PTC ThingWorx suffers from cross site scripting and password disclosure vulnerabilities. Versions affected include 6.5 through 7.4, 8.0.x, 8.1.x, and 8.2.x. ======================================================================= title: Password disclosure vulnerability & XSS product: PTC ThingWor...

Security Bulletin: Password disclosure via instrumentation log file in IBM Spectrum Protect Plus (CVE-2018-1768)

Summary IBM Spectrum Protect Plus may display the user id and password in plain text within the instrumentation log file. Vulnerability Details CVEID: CVE-2018-1768 DESCRIPTION: IBM Spectrum Protect Plus could disclose sensitive information when an authorized user executes a test operation, the...

Dell Laser MFP 2335dn Printer Password Disclosure Vulnerability - Active Check

Dell Laser MFP 2335dn Printer is prone to a password disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...

SynaMan 4.0 build 1488 - SMTP Credential Disclosure Vulnerability

Exploit for windows platform in category web applications Exploit Author: bzyo CVE: CVE-2018-10814 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Versio...

Google Chrome BoringSSL Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google, Inc. BoringSSL is a fork of the OpenSSL library used to implement encryption and TLS functionality in Google products. A security vulnerability exists in the SPAKE2 implementation of BoringSSL in versions of Google Chrome prior to 63.0.3239.84. ...

Default credentials

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account which is a low privilege account access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML...

CVE-2018-12710

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account which is a low privilege account access, an attacker can intercept the response from a POST request to obtain "Admin" rights due to the admin password being displayed in XML...

Open Microscopy Environment OMERO.web Information Disclosure Vulnerability

Open Microscopy Environment OMERO.web is a set of open source image management platform for Web applications. The platform supports a variety of image file formats , and image management , viewing and editing operations . An information disclosure vulnerability exists in the login form and change...

The vulnerability of Medtronic MyCareLink Patient Monitor’s medical equipment lies in the storage of passwords in a reversible format, which allows an intruder to disclose protected information.

The vulnerability of Medtronic MyCareLink Patient Monitor relates to the storage of passwords in a reversible format. Exploiting this vulnerability could allow an intruder to disclose protected information...

CVE-2018-5543

The F5 BIG-IP Controller for Kubernetes 1.0.0-1.5.0 k8s-bigip-crtl passes BIG-IP username and password as command line parameters, which may lead to disclosure of the credentials used by the container...

Davolink DVW 3200 Router Password Disclosure Vulnerability

The DVW 3200 is a router product from Davolink. The Davolink DVW 3200 router has a password disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...

Davolink DVW 3200 Router Password Disclosure

Exploit Title: Davolink DVW 3200 Router - Password Disclosure Google Dork: N/A Zoomeye dork : https://www.zoomeye.org/searchResult?q=%22var%20userpasswd%22%20%2Bapp%3A%22DAVOLINK%20GAPD-7000%20WAP%20httpd%22 Date: 2018-07-13 Exploit Author: Ankit Anubhav Vendor Homepage: www.davolink.co.kr Softwa...

Davolink DVW 3200 Router - Password Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: Davolink DVW 3200 Router - Password Disclosure Google Dork: N/A Zoomeye dork : https://www.zoomeye.org/searchResult?q=%22var%20userpasswd%22%20%2Bapp%3A%22DAVOLINK%20GAPD-7000%20WAP%20httpd%22 Date: 2018-07-13 Exploit Autho...

WordPress LimoLabs 1.0.0 Remote Password Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin LimoLabs-iCabbi Remote Password Disclosure Google Dork: inurl:"plugins/limolabs-icabbi" Exploit Author: Gabriel Lipski gabriel.lipskiATprotonmail.com Vendor Homepage: https://www.icabbi.com Tested on: Ubuntu...