129 matches found
HCL BigFix Platform 安全漏洞
HCL Technologies HCL BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform versions 9.5 to 9.5.19,...
CVE-2022-27544
BigFix Web Reports authorized users may see SMTP credentials in clear text...
YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak
The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ user an...
YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak
The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them PoC Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ use...
CVE-2021-22781
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...
CVE-2021-22781
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...
MTN Group: PHP Info Exposing Secrets at https://radio.mtn.bj/info
Summary: During recon I discovered a PHP Info file exposing environment variables such as; Laravel APPKEY, Database username/password, SMTP username/password, etc. Steps To Reproduce: Visit the following URL; https://radio.mtn.bj/info You will be presented with a PHP Info file exposing environmen...
Castel NextGen DVR Administrator Creation Vulnerability
Castel NextGen DVR is a network video device. A security vulnerability exists in Castel NextGen DVR that allows remote attackers to exploit the vulnerability by submitting a special request that could create an administrator user or obtain SMTP authentication credentials...
CVE-2020-11681
Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...
CVE-2020-11681
Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...
CVE-2020-11681
Castel NextGen DVR v1.0.0 stores and displays credentials for the SMTP server in cleartext. This enables a low-privileged user to create an administrator account and obtain SMTP credentials. The root cause, per the CVE details, is cleartext credential handling. Some sources note the issue was add...
NewStart CGSL CORE 5.04 / MAIN 5.04 : golang Multiple Vulnerabilities (NS-SA-2019-0047)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has golang packages installed that are affected by multiple vulnerabilities: - An arbitrary command execution flaw was found in the way Go's go get command handled the checkout of source code repositories. A remote attacker...
CVE-2019-5456
SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...
CVE-2019-1020009
Fleet before 2.1.2 allows exposure of SMTP credentials...
CVE-2019-1020009
Fleet before 2.1.2 allows exposure of SMTP credentials...
Command injection
Fleet before 2.1.2 allows exposure of SMTP credentials...
CVE-2018-10814
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials...
Default credentials
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials...
CVE-2018-10814
SynaMan 4.0 build 1488 is affected by a vulnerability where SMTP credentials are stored in plaintext, enabling information disclosure. The root cause is cleartext password storage in the configuration file (AppConfig.xml), which local users can read, leading to potential compromise of the SMTP ac...