CVE-2018-17922

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2018-24842)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardium version 10.5...

Puppet Enterprise Plaintext Transfer Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A plaintext transfer vulnerability...

CVE-2018-11749

CVE-2018-11749 affects Puppet Enterprise when startTLS with RBAC LDAP is configured; at login time, user credentials are sent in plaintext to the LDAP server. Affected PE versions: 2018.1.3, 2017.3.9, and 2016.4.14. Fixes are available in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. Seve...

CVE-2018-11749

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS...

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines Information Disclosure Vulnerability

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines are both products of Dell Dell. The former is a suite of disaster recovery and data protection software, and the latter is a disaster recovery solution for VMware environments. An information disclosure vulnerability exists in Dell EMC...

UTStar WA3002G4 Authentication Bypass Vulnerability

The UTStar WA3002G4 is a modem from UTStarcom USA. An authentication bypass vulnerability exists in the UTStar WA3002G4. An attacker can use this vulnerability to directly access administrator settings and obtain plaintext credentials from the HTML source...

IBM Cognos Business Intelligence Information Disclosure Vulnerability

IBM Cognos Business Intelligence BI is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards and scorecards, and can assist companies in adjusting their decisions by analyzing key factors and key stakeholders. A security vulnerability...

IBM Tivoli Identity Manager and Security Identity Manager Information Disclosure Vulnerability (CNVD-2018-08708)

IBM Tivoli Identity Manager and Security Identity Manager are both products of IBM Corporation of the U.S.A. IBM Tivoli Identity Manager is a suite of identity management software used to manage user rights across heterogeneous IT resources.Security Identity Security Identity Manager is an identi...

UbiQuoss Switch VP5208A Unauthorized Operation Vulnerability

UbiQuoss Switch VP5208A is a switch product from UbiQuoss Korea. A security vulnerability exists in the UbiQuoss Switch VP5208A, which originates from a user login failure where the program creates a bcmpassword file with user credentials in plaintext in /cgi-bin/. An attacker can obtain the...

SickRage Information Disclosure Vulnerability

SickRage is an automated video manager for managing and storing TV programs. A security vulnerability exists in versions prior to SickRage v2018.03.09-1, which stems from an HTTP response containing credentials in plaintext form. An attacker could exploit the vulnerability to obtain information...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

SAP HANA Information Disclosure Vulnerability (CNVD-2018-07951)

SAP HANA is a high-performance real-time data analytics platform from SAP. The platform provides data query functions, users can directly query and analyze a large amount of real-time business data. A security vulnerability exists in the optional capture&replay functionality in SAP HANA versions...

IBM Capacity Management Analytics Information Disclosure Vulnerability

IBM Capacity Management Analytics is a suite of capacity management analytics solutions from IBM USA for managing and predicting the usage of IBM zEnterprise infrastructure mainframe computer resources. A security vulnerability exists in IBM Capacity Management Analytics. A local attacker could...

IBM Security Guardium Big Data Intelligence (SonarG) User Credential Disclosure Vulnerability

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. A security vulnerability exists in IBM Security Guardium Big Da...

icebreaker - Gets Plaintext Active Directory Credentials If You'Re On The Internal Network

Break the ice with that cute Active Directory environment over there. Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you're inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plainte...

Automate Network Attacks Against Active Directory: icebreaker

Break the ice with that cute Active Directory environment over there. Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you’re inside the network but outside of the Active Directory environment. Performs 5 different network attacks for plainte...

Philips IntelliSpace Cardiovascular System and Xcelera System Plaintext Storage Vulnerability

The Philips IntelliSpace Cardiovascular and Xcelera systems predecessor to IntelliSpace Cardiovascular are comprehensive cardiac imaging and information management software. The Philips IntelliSpace Cardiovascular System and Xcelera System have a plaintext storage vulnerability where credentials...

Design/Logic Flaw

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file...