RdpThief

RdpThief RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

SMWYG-Show-Me-What-You-Got

SMWYG-Show-Me-What-You-Got This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever...

c0ntextomy

c0ntextomy an informal fallacy and a type of false attribution in which a passage is removed from its surrounding matter in such a way as to distort its intended meaning Wikipedia - Contextomy A Proof of Concept demonstrating the vulnerability with a debug session hijack, remote code execution, a...

CVE-2025-60791

CVE-2025-60791 CVE-2025-60791: Cleartext Storage of Sensitive Information in Memory. Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The...

CVE-2026-86715 Clear Text Storage of Password in Crypttech's Vatos DLP

Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

CVE-2026-86715

The Vatos DLP software, developed by Crypttech Crypto and Informatics Technologies Industry and Trade Inc., contains a plaintext storage of a password vulnerability. This flaw exists in versions from 1.1.176 before 1.1.243 , potentially allowing for the Use of Known Domain Credentials . The vulne...

CVE-2026-86715 Clear Text Storage of Password in Crypttech's Vatos DLP

Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

CVE-2026-90861

Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server...

EUVD-2026-113018

Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server...

CVE-2026-90861: Progress Software WS_FTP Server: Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in…

Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server...

PT-2026-132329

Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server...

Astra Linux - vulnerability in ceph

A flaw was found in Ceph versions prior to 16.y.z where Ceph stores mgr module passwords in plain text. This can be identified by searching the mgr logs for Grafana and Dashboard entries, which contain the passwords...

CVE-2026-15102

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services...

EUVD-2026-101473

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services...

PT-2026-114188

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services...

mimipenguin

MimiPenguin 2.0 Una herramienta para extraer la contraseña de inicio de sesión del usuario actual de escritorio Linux. Adaptada de la idea detrás de la popular herramienta de Windows mimikatz. Se le asignó CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Dato curioso: aún no se ha corregido...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2021_3081)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20213081 advisory. cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Tenable has extracted the preceding description block directly fr...

Debian dla-4797 : lemonldap-ng - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4797 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4797-1 [email protected] https://www.debian.org/lts/security/...

Build environment compiled into the library and readable at runtime

The build script of rustpython-vm 0.3.0 through 0.5.0 writes every environment variable of the build into $OUTDIR/envvars.rs. The crate compiles that file into sysconfigdata's buildtimevars. That module is always compiled. A binary built in CI with secrets in the environment carries those secrets...