3357 matches found
Johnson Controls Illustra Essentials Gen 4 (Update A)
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability...
Account Takeover
silverstripe/framework is vulnerable to Account Takeover. The vulnerability is due to plain text storage of user login attempts, which may include sensitive data like passwords mistyped into the username field. The vulnerability allows an attacker could gain unauthorized access to user credential...
CVE-2024-36115 Stored Cross site scripting in Reposilite artifacts
Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies i...
CVE-2024-33375
LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware...
CVE-2024-33375
The LB-LINK BL-W1210M wireless router (version v2.0 ) contains a vulnerability where user credentials, such as usernames and passwords, are stored in plaintext within the router's firmware. This lack of encryption allows an attacker operating remotely to gain unauthorized access to protected sens...
CVE-2024-25052
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363...
CVE-2024-25052
IBM Jazz Reporting Service 7.0.3 is vulnerable to information disclosure due to storing user credentials in plain text, readable by an administrator. The issue affects the IBM Jazz Reporting Service and, when Jazz Authentication Service is enabled, can expose the JSA Client Secret in clear text. ...
CVE-2024-25052 IBM Jazz Reporting Service information disclosure
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363...
CVE-2024-25052 IBM Jazz Reporting Service information disclosure
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363...
CVE-2024-25052: Plaintext Storage of a Password
IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363...
PT-2024-25222 · Lb Link · Lb-Link Bl-W1210M
Name of the Vulnerable Software and Affected Versions: LB-LINK BL-W1210M version 2.0 Description: The issue concerns the storage of user credentials in plaintext within the router's firmware. This means that sensitive information, such as usernames and passwords, is not encrypted and can be easil...
CVE-2024-5908
CVE-2024-5908 affects the Palo Alto Networks GlobalProtect app. The issue allows exposure of encrypted user credentials (used to connect to GlobalProtect) through application logs. Affected component is the GlobalProtect client; root cause is credentials being written to or included in log files ...
Trend Micro InterScan Web Security Virtual Appliance Cross-Site Scripting Vulnerability (CNVD-2024-40821)
Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A cross-site scripting vulnerability exists in the Trend Micro InterScan Web Security...
CVE-2024-26330
An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. After a successful logout, user credentials remain in memory while the process is still open, and can be obtained by dumping the process memory and parsing it...
CVE-2024-34684
CVE-2024-34684 affects SAP BusinessObjects Business Intelligence Platform (Scheduling) on Unix. An authenticated attacker with local administrator access can access the password of a local account, enabling retrieval of non-administrative credentials and allowing read/modify of remote server file...
CVE-2024-26330
An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. After a successful logout, user credentials remain in memory while the process is still open, and can be obtained by dumping the process memory and parsing it...
PT-2024-9398
Name of the Vulnerable Software and Affected Versions: Naumen Service Management Platform affected versions not specified Description: The issue is related to insufficient protection of service data on the Naumen Service Management Platform. It allows a remote attacker to obtain user credentials...
PT-2024-57: Information exposure in Yealink Meeting Server (YMS)
The vulnerability was identified in Yealink Meeting Server YMS, versions V26.0.0.67. The discovered vulnerability allows an attacker to access sensitive information, including user credentials. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 06.06.2024 Recommendations...
Cross-Site Scripting (XSS) vulnerabilities in Neos
It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials such as cookies. With the potential backdoor upload an attacker could gain access ...