1692 matches found
c0ntextomy
c0ntextomy an informal fallacy and a type of false attribution in which a passage is removed from its surrounding matter in such a way as to distort its intended meaning Wikipedia - Contextomy A Proof of Concept demonstrating the vulnerability with a debug session hijack, remote code execution, a...
SMWYG-Show-Me-What-You-Got
SMWYG-Show-Me-What-You-Got This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever...
RdpThief
RdpThief RdpThief por sí mismo es un DLL independiente que cuando se inyecta en el proceso mstsc.exe, realiza hooking de API, extrae las credenciales en texto claro y las guarda en un archivo. Un script de agresor lo acompaña, el cual es responsable de gestionar el estado, monitorear nuevos...
rConfig <=3.9.4 - SQL Injection
rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...
mimipenguin
MimiPenguin 2.0 Инструмент для извлечения пароля для входа текущего пользователя Linux Desktop. Адаптирован на основе идеи популярного инструмента mimikatz для Windows. Этот инструмент получил CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Забавный факт: до сих пор не исправлено после GNO...
CVE-2025-60791
CVE-2025-60791 CVE-2025-60791: Cleartext Storage of Sensitive Information in Memory. Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The...
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted plain-TCP connection, and the driver responds with the user's password in cleartext on the wire...
EUVD-2026-68023
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...
CVE-2026-55215
MariaDB Connector/Node.js is vulnerable to cleartext password disclosure via a man-in-the-middle attack when ssl: true is set without a pinned CA or server certificate. The root cause lies in the TLS handshake logic: in handshake.js, a server selecting mysql_clear_password as the initial authenti...
PT-2026-83376
Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver does not require a secure transport before using clear-text password authentication plugins. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest...
Astra Linux – Vulnerability in Ceph
A flaw was discovered in Ceph versions prior to 16.y.z, where Ceph stores mgr module passwords in plain text. This can be identified by searching the mgr logs using Grafana and the dashboard, as the passwords are visible...
CVE-2026-14163
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...
CVE-2026-14163
Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...
EUVD-2026-63209
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...
CVE-2026-14163
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...
PT-2026-78897
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description Under certain circumstances, sensitive variables may be printed in clear-text within the deployment variable snapshot. Recommendations At the moment, there is no information about a...
JLSEC-2026-1203 A vulnerability exists where a connection requiring TLS incorrectly reuses an existing...
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...
PYSEC-2026-2364 Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not...
CVE-2026-54704 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text...