3113 matches found
CVE-2023-30367
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
CVE-2023-30367
Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an encrypted state on disk. mRemoteNG version = v1.76.20 and =...
Information Disclosure
org.jenkins-ci.plugins:dimensionsscm is vulnerable to Information Disclosure. A remote authenticated attacker with Item/Configure permission is able to gain access to confidential user credentials due to improper authorization checks, resulting in the disclosure of sensitive information...
The vulnerability of the Telnet service of the cable modem Hitron CODA-5310 allows a intruder to gain access to user and administrator credentials.
The vulnerability of the Telnet service of the Microcable Gateway Hitron CODA-5310 lies in the transmission of confidential information in plaintext. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to user and administrator credentials...
AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plaintext
All-In-One Security AIOS, a WordPress plugin installed on over one million sites, has issued a security update after a bug introduced in version 5.1.9 of the software caused users' passwords being added to the database in plaintext format. "A malicious site administrator i.e. a user already logge...
CVE-2023-35697
Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials...
CVE-2023-35697
The CVE-2023-35697 refers to the SICK ICR890-4 track-and-trace device, with the root cause described as improper restriction of excessive authentication attempts, enabling a remote attacker to brute-force credentials. Publicly documented details indicate the vulnerability affects SICK ICR890-4 an...
Zinc Cross-site Scripting vulnerability
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s...
GHSA-7J6X-42MM-P7JM Zinc Cross-site Scripting vulnerability
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’...
PT-2023-25297 · Unknown · Piigab M-Bus
Name of the Vulnerable Software and Affected Versions: PiiGAB M-Bus affected versions not specified Description: The issue allows a low-level user to potentially gain admin credentials because PiiGAB M-Bus stores credentials in a plaintext file. Recommendations: At the moment, there is no...
CVE-2023-21176
In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...
CVE-2023-21176
In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
Code injection
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2020-18406
CVE-2020-18406 affects cmseasy v7.0.0 (CMS). The root cause is that form data is not encrypted, allowing user credentials to be sent in clear text. Several sources corroborate the issue and describe the impact as credential exposure over potentially plaintext channels. Documented risk factors inc...
CVE-2023-35928
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until...
IBM Security Directory Suite VA Information Disclosure Vulnerability (CNVD-2023-51456)
IBM Security Directory Suite is a scalable, standards-based identity platform from International Business Machines IBM that simplifies identity and directory management. An information disclosure vulnerability exists in IBM Security Directory Suite VA, which could be exploited by an attacker to...