CVE-2024-38291

In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation...

CVE-2024-38291

The CVE-2024-38291 entry applies to Extreme Networks ExtremeCloud IQ Site Engine (XIQ‑SE) prior to version 24.2.11. The vulnerability arises from a flaw that allows a low‑privileged user to access administrator passwords, enabling potential privilege escalation. Affected component/versions are XI...

CVE-2024-21757

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker ...

CVE-2024-21757

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker ...

CVE-2024-3082

A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers e.g., full-disk encryption have been enabled...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec&command= substring. This affects EG-2000SE...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec&command= substring. This affects EG-2000SE...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec&command= substring. This affects EG-2000SE...

CVE-2019-16639

Summary: CVE-2019-16639 affects Ruijie EG-2000 series gateways, notably EG-2000SE and EG_RGOS 11.9 B11P1. The issue is a newcli.php API interface without access control, enabling an attacker who has web interface access to run TELNET commands and potentially view admin passwords via the mode_url=...

PT-2024-13068 · Clarisa · Filemaker Server

Name of the Vulnerable Software and Affected Versions: FileMaker Server versions prior to 20.3.1 Description: The issue potentially exposed password information to front-end websites when signed in to the Admin Console with an administrator role. This was resolved by eliminating the send of Admin...

PT-2024-6533 · Fortinet · Fortimanager +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.0.0 through 7.0.10 Fortinet FortiManager versions 7.2.0 through 7.2.4 Fortinet FortiManager versions 7.4.0 through 7.4.1 Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10 Fortinet FortiAnalyzer versions 7.2...

CVE-2023-29064

The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts...

ownCloud vulnerability can be used to extract admin passwords

ownCloud has warned users about three critical security flaws in its file-sharing software which, if exploited, could reveal sensitive information and modify files. An especially and potentially impactful one is a vulnerability that could lead to disclosure of sensitive credentials and...

PT-2023-22121 · Unknown · Facschorus

Name of the Vulnerable Software and Affected Versions: FACSChorus affected versions not specified Description: The FACSChorus software stores sensitive information in plaintext, allowing a threat actor to obtain hardcoded secrets, including tokens and passwords for administrative accounts...

CVE-2023-5719

The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent % character, invalid values will be included, potentially truncating...

CVE-2023-37756

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

GHSA-9XG4-3QFM-9W8F Leaking sensitive user information still possible by filtering on private with prefix fields

Summary Still able to leak private fields if using the tnumber prefix Details Knex query allows you to change there default prefix SqliteError: select distinct t0. from pages as t0 left join adminusers as t1 on t0.updatedbyid = t1.id where t1.password = 1 so if you change the prefix to the same a...

PT-2023-24759

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8 Description The issue allows for the leakage of private fields when using the tnumber prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix t...