iCULeak.py

iCULeak.py Herramienta para encontrar y extraer credenciales de archivos de configuración de teléfonos en entornos gestionados por CUCM Call Manager de Cisco. Cuando se utiliza CUCM Call Manager de Cisco, los archivos de configuración de los teléfonos se almacenan en un servidor TFTP. Estos...

Digisol-DG-GR1321-s-Password-Storage-in-Plaintext-CVE-2024-4232

Digisol-DG-GR1321-s-Almacenamiento-de-Contraseña-en-Texto-Plano-CVE-2024-4232...

CVE-2026-80176

Dell Secure Connect Gateway 5.0 (SCG) Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00, respectively, contain a Plaintext Storage of a Password vulnerability. A low-privileged attacker with local access could exploit this flaw, resulting in information disclosure . The CVSS v...

EUVD-2026-72524

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

CVE-2025-70962

CVE-2025-70962 Uso de credenciales codificadas en el servicio RTSP de la cámara IP ZOSI C519M Campo| Valor ---|--- ID CVE| CVE-2025-70962 Fabricante| ZOSI Technology Producto| Cámara IP inteligente ZOSI C519M también listada como modelo 1NC-519M Versiones afectadas| Firmware V4.2.8.832C01450BA...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-19051

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19051

Menulux Portal by Menulux Software Inc. is vulnerable to plaintext storage of a password , allowing an authenticated low-privilege attacker to retrieve embedded sensitive data over the network. The vulnerability affects versions prior to 20260903211448 . The CNA-assigned CVSS 3.1 score is 7.1 (Hi...

CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 embed live TOTP shared secrets in plaintext inside user data export ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, effectively bypassing two-factor authentication . The CVSS 4.0 base score is 5.3 (...

CVE-2021-38489

HDD password plaintext is stored in a UEFI variable...

CVE-2021-38489

CVE-2021-38489 affects the HddPasswordPei driver in Insyde InsydeH2O 5.x firmware, as shipped in Siemens SIMATIC products. The root cause is that the HDD password is stored in plaintext within a UEFI variable, exposing it to attackers with local, high-privilege access. The vulnerability carries a...

EUVD-2021-34870

HDD password plaintext is stored in a UEFI variable...

CVE-2021-38489 HDD Password Stored In Plaintext

HDD password plaintext is stored in a UEFI variable...

CVE-2026-81683 openssl_encrypt before 1.4.9 Plaintext Private Key Storage

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

EUVD-2026-62940

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-76375

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

PT-2026-78802

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-53454

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

GHSA-6C8M-Q6G9-VRW3 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...