CVE-2018-2402

In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, see SAP Note 2362820 for more information about capture & replay, user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorization...

CredSSP Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Credential Security Support Provider protocol CredSSP. An attacker who successfully exploited this vulnerability could relay user credentials and use them to execute code on the target system. CredSSP is an authentication provider which processe...

CredsLeaker - Tool to Display A Powershell Credentials Box

This script will display a powershell credentials box that will ask the user for his credentials. The box cannot be closed only by killing the process will keeps checking the credentials against the DC. When validated, it will close and leak it to a web server outside. How To: 1. Start a web...

Directory traversal

A vulnerability in the credential reset functionality for Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to...

CVE-2018-0213

A vulnerability in the credential reset functionality for Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to...

CVE-2018-0214

A vulnerability in certain CLI commands of Cisco Identity Services Engine ISE could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands should have been restricted from this...

HTTP SickRage Password Leak

SickRage use auxiliary/scanner/http/http/sickragepasswordleak msf undefinedsickragepasswordleak show actions ...actions... msf undefinedsickragepasswordleak set ACTION msf undefinedsickragepasswordleak show options ...show and set options... msf undefinedsickragepasswordleak run This module...

Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

A vulnerability in the credential reset functionality for Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to...

CVE-2017-1787

IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. IBM X-Force ID: 137022...

CVE-2017-1787

IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. IBM X-Force ID: 137022...

CVE-2018-1377

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778...

Code injection

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778...

CVE-2018-1377

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778...

CVE-2018-1377

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plaintext, exposing them to a local attacker (CVE-2018-1377). CVSSv3 base score 7.8 (HIGH) with local access and impact to confidentiality, integrity, and availability. IBM’s remediation is in version 3.2 ; upgrad...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0092

A vulnerability in the network-operator user role implementation for Cisco NX-OS System Software could allow an authenticated, local attacker to improperly delete valid user accounts. The network-operator role should not be able to delete other configured users on the device. The vulnerability is...

CVE-2018-0088

A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software could allow an authenticated, local attacker to impact the stability of the device. This could result in arbitrary code execution or a denial of service DoS...

CVE-2018-0088

A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software could allow an authenticated, local attacker to impact the stability of the device. This could result in arbitrary code execution or a denial of service DoS...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

Hardcoded credentials

cgi-bin/mft/wirelessmft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-code...