Omise: Brute force of a current password on a disable 2fa leads to guess password and disable 2fa.

Summary: This Attack happen when victim login in other device and forget to logout ,Then attacker can enable 2-factor authentication by brute fore the password of victim endpoints. Steps To Reproduce: 1Login in https://dashboard.omise.co/signin 2 Click on your username 3Navigate to Two-factor...

CVE-2022-23129

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when...

Design/Logic Flaw

Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when...

CVE-2022-23129

CVE-2022-23129 affects Mitsubishi Electric MC Works64 and ICONICS GENESIS64 where exporting GridWorX Server configuration to CSV saves authentication information in plaintext. Affected products: ICONICS GENESIS64 (versions 10.90 to 10.97) and MC Works64 (prior to 4.04E / 10.95.210.01). Root cause...

Cisco IP Phone Cleartext Password Storage Vulnerability

Cisco IP Phone Series 78x1, 88x5, 88x1, 7832, 8832, 8821 and 3905 suffer from an insecure password storage vulnerability. ======================================================================= title: Cleartext Storage of Phone Password product: Cisco IP Phone Series 78x1, 88x5, 88x1, 7832, 8832,...

CVE-2021-20827

CVE-2021-20827 describes plaintext storage of a password vulnerability in IDEC PLCs, allowing an attacker to obtain PLC Web server credentials from SD cards (ZLD files) or file backups and potentially hijack the PLC. Affected products and versions include IDEC FC6A/MICROSmart All-in-One CPU Modul...

CVE-2021-20827

Plaintext storage of a password vulnerability in IDEC PLCs FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier allows an...

Design/Logic Flaw

The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query...

SUSE: Security Advisory (SUSE-SU-2021:4011-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-37187

The CVE-2021-37187 issue affects Digi TransPort devices (through 2021-07-21). An authenticated attacker can read a password file containing reversible passwords, enabling decoding of other users’ passwords. Impact is partial confidentiality loss with potential broader exposure within the device. ...

Reprise Software Reprise License Manager 访问控制错误漏洞

Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License Manager A licensing...

Hardcoded credentials

Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may potentially exploit this vulnerability to gain unauthorized access to the system...

HealthForYou 1.11.1 / HealthCoach 2.9.2 Missing Password Policy

Trovent Security Advisory 2104-03 Missing server-side password policy Overview Advisory ID: TRSA-2104-03 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2104-03 Affected product: HealthForYou & Sanitas HealthCoach mobile and web applications Tested...

FortiSIEM - plaintext storage of sensitive data in Windows Agent

A plaintext storage of a password vulnerability CWE-256 in the FortiSIEM Windows Agent may allow an authenticated user to impersonate the agent registered to the Supervisor via reading specific log files...

CVE-2010-2496

The CVE-2010-2496 issue affects stonith-ng in pacemaker and cluster-glue where passwords were passed as command-line parameters. This allowed local attackers to access HA stack passwords and potentially influence cluster operations. A fix is available in cluster-glue 1.0.6 and newer and pacemaker...

Design/Logic Flaw

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it...

Weak Password Vulnerability in Infinova HD Network Mini Dome

Infinova, founded in 1993, is a smart city and smart home solution provider and operation service provider with smart security as its core, providing smart security, smart city, smart home, big data and internet operation services for the world. A weak password vulnerability exists in Infinova HD...

CVE-2021-33903

In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. However, changing the password of the root user via LANconfig does change the password of the root user for...

CVE-2021-33903

CVE-2021-33903 affects LANCOM LCOS releases 10.40–10.42.0473-RU3 with SNMPv3 enabled: changing the root password via the CLI does not update the SNMPv3 password, while using LANconfig does update it. The root cause is not detailed in the provided documents. No explicit exploits, mitigation, or af...

in pheditor/pheditor

Description With your new fix in https://github.com/pheditor/pheditor/commit/69a79e3ba7f4a9f844cf5919c14a953e4a0d1867, it is basically impossible to change the password now because you forgot to add in the CSRF token in the reset password functionality, hence the password cannot be changed from...