CVE-2020-6824

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwor...

CVE-2020-11687

CVE-2020-11687: JetBrains TeamCity pre-2019.2.2 disclosed passwords on several pages due to unmasked password values. Root cause: passwords not masked in UI. Impact: potential information disclosure of passwords. Mitigation: upgrade to TeamCity 2019.2.2 or later (per JetBrains security bulletin l...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25368)

Evenroute IQrouter is a smart router from Evenroute USA. A security vulnerability exists in the 'resetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the password of the root account...

CVE-2020-11965

In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step fo...

CVE-2020-5721

MikroTik WinBox 3.22 and earlier stores the user’s cleartext password in settings.cfg.viw when Keep Password is enabled and no Master Password is set. By default Keep Password is on and Master Password is not set, so an attacker with access to the configuration file can extract usernames and pass...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with O8.x released in China and India software. The S Secure app can access the content of a locked app without a password. The Samsung ID is SVE-2019-13805 October 2019...

Mail.ru: Brute-force any email account through allods.mail.ru

!!! Полная версия отчета со скриншотами находится во вложенном PDF-файле. Vulnerability Technical description ========================= По адресу https://allods.mail.ru/account.php находится форма регистрации нового пользователя в игре. В процессе заполнения формы, посылается Ajax POST-запрос в...

CVE-2020-6794

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master...

Moxa PT-7528 and PT-7828 Series Weak Password Vulnerability

Moxa PT-7528 and PT-7828 Series are both Ethernet switches manufactured by Moxa. A weak password vulnerability exists in the Moxa PT-7528 and PT-7828 Series, which can be exploited by an attacker to gain unauthorized access to the system...

Moxa EDS-G516E and EDS-510E series weak password vulnerability

Moxa EDS-G516E and EDS-510E series are both Ethernet switches manufactured by Moxa. A weak password vulnerability exists in the Moxa EDS-G516E and EDS-510E series, which can be exploited by attackers to obtain sensitive information...

CVE-2014-0234

Technical details for CVE-2014-0234 are not publicly available in the provided documents. No affected product/version/impact is specified here. Monitor for updates in the connected sources for exact remediation guidance.

CVE-2020-8631

A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the...

CVE-2020-8632

In cloud-init up to 19.4, CVE-2020-8632 affects rand_user_password in cloudinit/config/cc_set_passwords.py, where a small default pwlen makes password guessing easier. This is a local vulnerability (attack vector: LOCAL) with partial confidentiality impact and no integrity/availability impact per...

Security Bulletin: Password management vulnerability affects IBM Sterling B2B Integrator (CVE-2016-5890)

Summary IBM Sterling B2B Integrator Standard Edition could allow authenticated attacker to change another user's password . Vulnerability Details CVEID: CVE-2016-5890 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition contains an unspecified vulnerability that would allow an authenticated...

postgresql: Stack-based buffer overflow via setting a password

PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the...

Hardcoded credentials

Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account...

CVE-2012-1562

Joomla! core before 2.5.3 allows unauthorized password change...

CVE-2019-5990

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer...

Design/Logic Flaw

Anviz access control devices allow remote attackers to issue commands without a password...

Weak Password Vulnerability in Tianrongxin NGFW® Next-Generation Firewall

NGFW®, the next-generation firewall of TIANRONGXIN, adopts its own patented operating system NGTOS and security engine, utilizes the advanced Intel® Xeon® processor family and integrates the packet processing framework provided by Intel® Data Plane Development Kit to provide network processing...