Design/Logic Flaw

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-15786

A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation incl. SIPLUS variants All versions V16, SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions = V16, SIMATIC HMI Mobile Panels All versions = V16, SIMATIC HMI Unified Comfort Panels All versions = V16. Affected...

Authentication flaw

A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels All versions = V16. Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a...

CVE-2020-15786

A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation incl. SIPLUS variants All versions V16, SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions = V16, SIMATIC HMI Mobile Panels All versions = V16, SIMATIC HMI Unified Comfort Panels All versions = V16. Affected...

Siemens SIMATIC HMI Product Authentication Vulnerability

Siemens SIMATIC HMI panels are HMI software used to operate and monitor machines and equipment. A security vulnerability exists in Siemens SIMATIC HMI products. A remote attacker could use a brute force attack to discover user passwords and gain access to Sm@rt Server...

CVE-2020-7492

A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded...

CVE-2020-11560

CVE-2020-11560 affects NCH Express Invoice 7.25. Local users can read the application’s configuration file to obtain cleartext passwords, enabling potential account takeover. Root cause: credentials stored in plaintext in the configuration/files under the Express Invoice data path. Exploitation d...

CVE-2020-5725

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords...

CVE-2020-6984

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable...

Unspecified Vulnerability in Technicolor TC7337NET

Technicolor TC7337NET is a modem from the French company Technicolor. A security vulnerability exists in Technicolor TC7337NET version 08.89.17.23.03, which can be exploited by an attacker to discover passwords by sniffing the "Authorization:Basic" HTTP header in the network...

CVE-2020-10376

CVE-2020-10376 affects Technicolor TC7337NET devices (version 08.89.17.23.03). The issue enables remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header. This reflects a credential disclosure vulnerability exposed over network traffic. No remediati...

Design/Logic Flaw

BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to valusers.php3...

CVE-2020-10248

BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to valusers.php3...

Centreon 19.10.5 - Database Credentials Disclosure

Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE : - Centreon 19.10.5 Database...

Design/Logic Flaw

An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterprise H01-H01AAE and L01-L01AAF. By reading ADB or AADB file content within the Installation subvolume, a Guardian user can discover the...

CVE-2019-19539

An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterprise H01-H01AAE and L01-L01AAF. By reading ADB or AADB file content within the Installation subvolume, a Guardian user can discover the...

CVE-2020-6954

An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a mediafolder.cgi?applymode=pingserver URI...

CVE-2019-14246

CVE-2019-14246 affects CentOS Web Panel (CWP) 0.9.8.851. An insecure object reference in the PHPMyAdmin password change flow enables an attacker account to discover or retrieve phpMyAdmin passwords for any user (password data in /etc/passwd) through the affected web interface path. The vulnerabil...

Design/Logic Flaw

virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to virtbootstrap.py...

Cross site request forgery (csrf)

Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request...