Siemens SICLOCK TC Product Information Disclosure Vulnerability

The SICROCK product line offers components for synchronizing plant and system time. An information disclosure vulnerability exists in Siemens SICLOCK TC products. An attacker could exploit the vulnerability to read the access password of the device...

CVE-2018-8902

An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include...

CVE-2018-7949

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users ...

Anni 5 in 1 XVR Information Disclosure Vulnerability

Anni 5 in 1 XVR is a multi-functional DVR device from China Anni Anni Digital Technology Company. A security vulnerability exists in the download.rsp file in the Anni 5 in 1 XVR device. A remote attacker can exploit this vulnerability to download configuration information and obtain passwords...

Samsung Mobile Device Buffer Overflow Vulnerability

Samsung mobile devices are smart mobile devices manufactured by Samsung in South Korea.Android L, M, and N are a set of different versions of the Linux-based open source operating system developed by Google and the Open Handset Alliance OHA.Exynos Exynos chipsets are processors designed and...

CVE-2017-14009

An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature on the application, the current password for the user is specified in plaintext. This may allow an attacker who has been authenticated to...

VMware vSphere Data Protection (VDP) Multiple Vulnerabilities

VMware vSphere Data Protection VDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SMA Solar Technology inverter weak password vulnerability (CNVD-2017-27842)

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. A weak password vulnerability exists in the SMA Solar Technology inverter, which stems from a weak password policy used by the program and can be exploited by an attacker to obtain a password...

Pilot Future (Beijing) Technology Co., Ltd. digital campus learning platform has an administrator arbitrary password login vulnerability

Microknowledge Base is to provide a platform for the operation and management of self-resource libraries. An administrator arbitrary password login vulnerability exists in the Digital Campus Learning Platform. The vulnerability stems from a hard-coded or permission judgment business logic...

CVE-2017-8837

Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain...

Design/Logic Flaw

IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed...

CVE-2016-5918

IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed...

Moderate: Red Hat Security Advisory: libvirt security, bug fix, and enhancement update

An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2015-8086

Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC5...

OurPHP Backend Web Feature Management SQL Injection Vulnerability

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. OurPHP OurPHP management background global column under the website function management module in the configuration of saving the anti-injection processing of the pag...

The vulnerability of the SAP HANA database management system allows a hacker to gain access to protected information or obtain passwords.

The vulnerability of the Web Dispatcher service in the SAP HANA database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information or obtain passwords...

Pentaho GA PDI & Pentaho GA BA Authentication Bypass Vulnerability

Pentaho is a suite of open source business intelligence products. An authentication bypass vulnerability exists in Pentaho GA PDI & Pentaho GA BA, which can be exploited by an attacker to access sensitive files and obtain password information...

PT-2016-09: Password Access in ABB PCM600

The specialists of the Positive Research center have detected a Password Access vulnerability in ABB PCM600. After you change the Main Application Password, it is stored to the configuration file as a clear text. How to fix Update your software up to the latest version Advisory status 09.06.2015 ...

PT-2014-08: Password Access in Solar-Log

The specialists of the Positive Research center have detected a Password Access vulnerability in Solar-Log. Application uses some kind of "encryption" for password stored in the configuration file with a static key. Attacker can get a password in plain text. How to fix Update your firmware up to...

PT-2015-14: Password Access in Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014

The specialists of the Positive Research center have detected a Password Access vulnerability in Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Systems do not encrypt user passwords, which allows attackers to access them. How to fix Update your system up to the latest...