PT-2024-34773 · Transsion · Com.Transsion.Carlcare

Name of the Vulnerable Software and Affected Versions: com.transsion.carlcare affected versions not specified Description: The issue is related to improper permission settings for mobile applications, which may lead to user password and account security risks. Recommendations: At the moment, ther...

PT-2024-7964 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to the backup function in Brocade SANnav, which stores confidential information insecurely. This allows a local attacker to recover backup...

CVE-2023-35837

An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has a default password, equal to the registration ID of the device. This same registration ID is used as...

PT-2023-23306 · Lms5Xx · Lms5Xx

Name of the Vulnerable Software and Affected Versions: LMS5xx affected versions not specified Description: The issue is related to weak hash generation methods used by the LMS5xx, resulting in the creation of insecure hashes. If an attacker retrieves the hash, it could lead to collision attacks a...

The vulnerability of the text field for entering the password of the KeePass password manager lies in the fact that user credentials are stored in an unencrypted form. This allows a hacker to retrieve the master password in its raw form.

The vulnerability of the password input field for the KeePass password manager’s administrator password storage is related to the storage of user data in an unencrypted form. Exploiting this vulnerability could allow a malicious actor to retrieve the master password in its raw form...

PT-2022-28195 · Unknown · Prometheus

Name of the Vulnerable Software and Affected Versions: Prometheus versions prior to 2.37.4 Prometheus versions prior to 2.40.4 Description: A flaw in the implementation of basic authentication in Prometheus allows attackers who know the hashed password to authenticate against Prometheus. This is...

CVE-2022-26885 Apache DolphinScheduler config file read by task risk

When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher...

PT-2022-26066 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue allows unauthenticated users to trigger the WriteConfiguration method. This could enable an attacker to modify user configuration files, such as...

CVE-2022-3206 Passster < 3.5.5.5.2 - Insecure Storage of Password

The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked...

CVE-2022-3206 Passster < 3.5.5.5.2 - Insecure Storage of Password

The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked...

TOTOLINK A3100R 信任管理问题漏洞

The TOTOLINK A3100R is a wireless router. The TOTOLINK A3100R suffers from a trust management issue vulnerability that can be exploited by an attacker to obtain the root password...

CVE-2021-29012

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid temporarily during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus...

Mozilla: Software keyboards may have remembered typed passwords

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field wa...

Cryptographic Algorithm Vulnerability in ABB Industrial Robot Teachers

ABB China Ltd. is committed to providing solutions for customers in the industrial, energy, power, transportation and construction sectors. A vulnerability exists in the encryption algorithm of the ABB industrial robot demonstrator. The vulnerability can be exploited by an attacker to crack the...

Unspecified Vulnerability in Tracker Software PDF-XChange Editor

Tracker Software PDF-XChange Editor is a Canadian Tracker Software company's set of software for viewing, editing PDF format files. A security vulnerability exists in Tracker Software PDF-XChange Editor versions prior to 8.0.330.0, which can be exploited by an attacker to steal NTLM hashes and th...

CVE-2017-8296

kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password...

UBUNTU-CVE-2017-8296

kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master password if the "password" command is used with an argument. The names of the password...

UPC Ireland Cisco EPC 2425 Router / Horizon Box

Exploit for hardware platform in category web applications The Cisco EPC 2425 routers supplied by UPC are vulnerable to an offline dictionary attack if the WPA-PSK handshake is obtained by an attacker. The WPA-PSK pass phrase has the following features: • Random • A to Z Uppercase only • 8...

Digital Alert Systems DASDEC and Monroe Electronics R189 One-Net firmware exposes private root SSH key

Overview Digital Alert Systems DASDEC and Monroe Electronics One-Net E189 Emergency Alert System EAS devices exposed a shared private root SSH key in publicly available firmware images. An attacker with SSH access to a device could use the key to log in with root privileges. Description The Digit...

CVE-2004-0082

The mksmbpasswd shell script mksmbpasswd.sh in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password...