Design/Logic Flaw

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin...

Moxa EDR-810 Web Server Weak Cryptography for Passwords Vulnerability(CVE-2017-12129)

Summary An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could intercept weakly encrypted passwords and could brute force them. Tested Versions Moxa EDR-810 V4.1 build 17030317 Product URLs...

Moxa EDR-810 Cleartext Transmission of Password Vulnerability(CVE-2017-12123)

Summary An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as...

Moxa EDR-810 Cleartext Transmission of Password Vulnerability

Summary An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as...

MetInfo Arbitrary Password Change Vulnerability

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. The reset password function in MetInfo 6.0 has an arbitrary password change...

Foxconn femtocell FEMTO AP-FC4064-T Default Password Vulnerability

The Foxconn femtocell FEMTO AP-FC4064-T is a home base station device from Foxconn. A security vulnerability exists in the Foxconn femtocell FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 version, which stems from the use of a weak default password for privileged accounts. The vulnerability...

CVE-2018-1000104

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...

CVE-2018-1000104

CVE-2018-1000104 affects Jenkins Coverity Plugin at 1.10.0 and earlier, where CIMInstance.java stores passwords in plaintext. An attacker with local file-system access or control of a Jenkins administrator’s browser (e.g., a malicious extension) can retrieve the keystore and private key passwords...

ask2 Q&A system front user.php file exists arbitrary user password change vulnerability

ask2 Q&A is an open source PHP Q&A program. There is an arbitrary user password change vulnerability in the ask2 Q&A System frontend user.php file. An attacker can exploit the vulnerability to directly modify the password of the administrator user...

CVE-2017-11632

An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers to obtain administrative access via a TELNET session...

CVE-2015-5314

The eappwdprocess function in eapserver/eapserverpwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with 1 an internal EAP server or 2 a RADIUS server and EAP-pwd is enabled in a runtime configuration, which allows remote...

Weak Password Vulnerability in iClock Series Data Services of Zhongguancun Attendance Management System

Ltd. is the sales and service organization in Shanghai of the famous biometrics and RFID products provider, China Control Technology. A weak password vulnerability exists in the iClock series of data services of the Time and Attendance Management System TAMS, which can be exploited by attackers t...

PacketFence Bypass Authentication Vulnerability

PacketFence is an open source network access control solution. A security vulnerability exists in the 'checkpassword' function in the html/admin/login.php file in versions prior to PacketFence 3.0.2. A remote attacker can exploit this vulnerability to bypass authentication with the help of an emp...

CVE-2018-6353

The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering 1 social-engineering attacks in which a user pastes code that they do not understand and 2 code pasted by a physically proximate attacker at an unattended workstation, which makes...

CVE-2017-18021

It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GUI...

PySAML2 Password Acceptance Vulnerability

PySAML2 is an implementation of SAML2 written in python. A security vulnerability exists in PySAML2 4.4.0 and earlier versions, which stems from the program receiving arbitrary passwords. An attacker can exploit the vulnerability to log in as an arbitrary user...

PYSEC-2018-48

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

Weak Password Vulnerability in Backend Management System of Suzhou Longye Network Technology Co.

Suzhou Longye Network Technology Co., Ltd. is a network company. It is mainly engaged in website project planning, webpage production, web-based database development and website maintenance. A weak password vulnerability exists in the backend management system of Suzhou Longye Network Technology...

CVE-2017-5254

CVE-2017-5254 affects Cambium Networks ePMP firmware 3.5 and earlier. The issue lets non-administrative users labeled installer/home change passwords of other accounts (including admin) after bypassing a client-side protection mechanism, enabling privilege elevation. Documented impact is high (pa...

Geneko Routers Information Disclosure Vulnerability

Geneko Router version 3.18.21 is vulnerable to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...