PT-2025-32981 · Zkteco · Zkteco Wl20

Name of the Vulnerable Software and Affected Versions: ZKTeco WL20 affected versions not specified Description: The device stores a private key in plaintext within its firmware. An attacker with physical access can extract the firmware, analyze the binary data, and retrieve the private key...

CVE-2025-40753

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extra...

CVE-2025-40752

CVE-2025-40752 affects Siemens POWER METER SICAM Q100/Q200 (Q100 variants 2.60–2.61/2.60–2.61 for certain SKUs) and SICAM Q200 (2.70–2.79) where SMTP password is stored in cleartext. This allows an authenticated local attacker to read the SMTP credentials from the device configuration and abuse t...

Linux Distros Unpatched Vulnerability : CVE-2025-49087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS7 paddin...

Siemens POWER METER SICAM Q100和Siemens POWER METER SICAM Q200 安全漏洞

Siemens POWER METER SICAM Q100 and Siemens POWER METER SICAM Q200 are multifunctional power quality recorders from Siemens, Germany. A security vulnerability exists in Siemens POWER METER SICAM Q100 and Siemens POWER METER SICAM Q200 prior to version V2.62, which stems from the plaintext storage ...

Linux Distros Unpatched Vulnerability : CVE-2018-0497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery for a CBC based ciphersuite via a...

CVE-2025-52586

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write...

Linux Distros Unpatched Vulnerability : CVE-2020-36476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 2.24.0 and before 2.16.8 LTS and before 2.7.17 LTS. There is missing zeroization of plaintext buffers in mbedtlssslre...

CVE-2025-8741 macrozheng mall login cleartext transmission

A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The...

CVE-2025-52586

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write...

CVE-2025-52586

The CVE-2025-52586 issue affects EG4 Electronics EG4 Inverters, where MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext. The root impact described across sources is interception, manipulation, replay, or forging of sensitive commands/data (voltag...

CVE-2025-52586 EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write...

CVE-2025-54876

The Janssen Project is an open-source identity and access management IAM platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local clicmd.log file. This is fixed in the nightly prerelease...

Linux Distros Unpatched Vulnerability : CVE-2019-17005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leadin...

PT-2025-32368

Name of the Vulnerable Software and Affected Versions: Inverter affected versions not specified Description: The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This may allow an attacker with access to a loca...

The vulnerability of the Mbed TLS software lies in its use of hidden time channels for data transmission, which allows a hacker to recover the plaintext.

The vulnerability of Mbed TLS software is related to the use of hidden time channels for data transmission. Exploiting this vulnerability allows a remote attacker to recover the exposed text...

CVE-2025-54870

VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround thi...

Linux Distros Unpatched Vulnerability : CVE-2018-19608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in...

Linux Distros Unpatched Vulnerability : CVE-2024-45004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load...

CVE-2025-54876

The Janssen Project is an open-source identity and access management IAM platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local clicmd.log file. This is fixed in the nightly prerelease...