tpm2-tools Authentication Authorization Vulnerability

tpm2-tools is a toolkit for monitoring trusted platform modules in Linux. A security vulnerability exists in versions of tpm2-tools prior to 1.1.1, which stems from the program passing passwords from the client to the server in plaintext. An attacker could exploit the vulnerability to obtain...

Cognito Software Moneyworks Password Disclosure Vulnerability

MoneyWorks is a multi-platform accounting solution. A password disclosure vulnerability exists in Cognito Software Moneyworks. The vulnerability stems from detailed logging that writes the administrator password to a globally readable file. An attacker could use this vulnerability to gain...

EFS Easy Chat Server Password Information Disclosure Vulnerability

Easy Chat Server is a live chat system. A password information disclosure vulnerability exists in EFS Easy Chat Server 'register.ghp'. A remote, unauthenticated attacker could send an HTTP GET request to obtain any Easy Chat Server user password...

CVE-2017-9557

register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username parameter in conjunction with an empty password parameter, and reading the HTML source code of the response...

EFS Easy Chat Server 3.1 - Password Disclosure

EFS Easy Chat Server 3.1 - Password Disclosure Exploit Title: Easy Chat Server Remote Password Disclosure Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Pre-Auth Remote Password Disclosure...

Easy Chat Server 3.1 Password Disclosure

Exploit Title: Easy Chat Server Remote Password Disclosure Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Pre-Auth Remote Password Disclosure Severity: Critical...

Uniview NVR - Password Disclosure

Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structure. In addition, the users' passwor...

EFS Easy Chat Server 3.1 - Password Disclosure

Exploit Title: Easy Chat Server Remote Password Disclosure Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Pre-Auth Remote Password Disclosure Severity: Critical...

Uniview NVR - Password Disclosure

Uniview NVR - Password Disclosure Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structur...

Belden GarrettCom 6K / 10KT Bypass / Disclosure / Buffer Overflow

Introduction ------------ Vulnerabilities were identified in the Belden GarrettCom 6K and 10KT Magnum series network switches. These were discovered during a black box assessment and therefore the vulnerability list should not be considered exhaustive; observations suggest that it is likely that...

Insecure log configuration in TREX

Application: SAP TREX Versions Affected: SAP TREX 7.1-7.25 Vendor URL: SAP Bug: Information disclosure Reported: 16.05.2017 Vendor response: 17.05.2017 Date of Public Advisory: 12.09.2017 Reference: SAP Security Note 2489196 Author: Nursultan Abubakirov ERPScan VULNERABILITY INFORMATION Class:...

Vulnerability in core server (CVE-2017-7486)

pgusermappings view discloses foreign server passwords...

IBM Tivoli Storage Manager Password Disclosure Vulnerability

IBM Tivoli Storage Manager TSM is a backup and recovery management solution from IBM USA. The solution supports data protection, space management and archiving, business recovery and disaster recovery. A password disclosure vulnerability exists in IBM TSM. A local attacker could exploit this...

CVE-2017-8391

The CVE-2017-8391 entry concerns the OS Installation Management component of CA Client Automation (versions r12.9, r14.0, r14.0 SP1). The root cause is that during operating system installation, an encrypted password is written to a readable local file, allowing a local attacker to read and obtai...

CVE-2017-8296

kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password...

CVE-2017-8296

kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password...

Schneider Electric Modicon TM221CE16R Information Disclosure Vulnerability

The Schneider Electric Modicon TM221CE16R is a programmable controller from Schneider Electric France. A security vulnerability exists in the Schneider Electric Modicon TM221CE16R version 1.3.3.3. A remote attacker can exploit this vulnerability by sending a...

CVE-2016-3037

IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could obtain this sensitive information. IBM X-Force ID: 114613...

CVE-2016-3037

IBM Cognos TM1 10.1 and 10.2 contain a vulnerability where a service can return the victim’s password when a valid session key is present. An authenticated attacker who can interact with the UI could obtain this sensitive information, impacting confidentiality. Affected releases include TM1 10.1,...

CVE-2017-7575

Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01\x5a\x00\x03\x00 request to the Modbus port 502/tcp. Subsequently the application may be arbitrarily downloaded, modified, and uploaded...