CVE-2018-1360

Fortinet FortiManager 5.2.x (<=5.2.7) and 5.4.x (

CVE-2019-10239

Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers under the same user context to obtain cleartext credentials of the stored account...

CVE-2019-10239

CVE-2019-10239 affects Robotronic RunAsSpc 3.7.0.0. The root cause is insufficient protection of stored credentials, enabling locally authenticated attackers under the same user context to obtain cleartext credentials from the stored account. The NVD entry records a low base score (CVSS2: 2.1, LO...

CVE-2019-10710

Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda,...

Design/Logic Flaw

Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda,...

CVE-2019-10710

Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda,...

CVE-2019-11350

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

CVE-2019-11350

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

Default credentials

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

CVE-2019-11350

CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page...

CVE-2019-11350

CVE-2019-11350 affects CloudBees Jenkins Operations Center 2.150.2.3. When an expired trial license exists, the proxy configuration page allows cleartext password storage and retrieval. This is documented across NVD and Red Hat notices for CVE-2019-11350. CVSSv3.0 shows a base score of 9.8 (CRITI...

CVE-2018-17287

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17287

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation...

CVE-2018-17287

CVE-2018-17287 affects Kofax Front Office Server Administration Console (version 4.1.1.11.0.5212). The issue arises because some fields (e.g., passwords) are obfuscated in the front-end but can be exfiltrated via the back-end download feature (mfp.password downloadsettingvalue operation). This co...

GHSA-JWQM-C9F2-2CQ3 Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected...

CVE-2019-10676

An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within t...

CVE-2019-10676

An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within t...

Default credentials

An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within t...

CVE-2019-10676

In Uniqkey Password Manager 1.14, CVE-2019-10845 describes a vulnerability where the credential-saving pop-up (id="uniqkey-password-popup" / password-popup/popup.html) can be read and manipulated by remote servers. The pop-up persists across pages until a user makes a decision, and the popup wind...