Code injection

The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency by leveraging root access to read /com.biepie/sharedprefs/com.bitpiepreferences.xml on Android or a plist file in the app data folder on iO...

CVE-2018-10812

The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which allows local users to steal currency by leveraging root access to read /com.biepie/sharedprefs/com.bitpiepreferences.xml on Android or a plist file in the app data folder on iO...

CVE-2018-10812

The CVE-2018-10812 vulnerability affects the Bitpie application (Android and iOS) up to version 3.2.4. The issue stems from cleartext storage of the digital currency’s initial keys, allowing a local attacker with root access to read sensitive data: /com.biepie/shared_prefs/com.bitpie_preferences....

CVE-2018-10641

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2018-10641

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

Default credentials

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2018-10641

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext...

CVE-2018-10641

CVE-2018-10641 affects the D-Link DIR-601 A1 (firmware version 1.02NA). The vulnerability allows password changes without presenting the current password, and the new credentials are transmitted in cleartext. This constitutes an authentication bypass enabling potential information exposure (param...

PT-2018-3908 · D Link · D-Link Dir-601

Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 version 1.02NA Description: The issue is related to the authentication procedure in the D-Link DIR-601 router, which has shortcomings. This allows a remote attacker to bypass existing security restrictions. The password change...

Uber: Cleartext password exposure allows access to the desafio5estrelas.com admin panel

Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site...

CVE-2018-1074

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...

Design/Logic Flaw

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...

CVE-2018-1074

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...

CVE-2018-1074

CVE-2018-1074 affects ovirt-engine API and administration web portal before versions 4.2.2.5 and 4.1.11.2, exposing Power Management credentials (cleartext passwords) to Host Administrators who control the hosts. This could allow escalation to power-management systems. Connected sources confirm t...

CVE-2018-1074

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts the...

Ericsson-LG iPECS NMS A.1Ac Credential Disclosure

-- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem GAPksel Contact: twitter.com/berkcgoksel || bgoksel.com Vendor Homepage: http://www.ipecs.com/...

Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure

-- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem Göksel Contact: twitter.com/berkcgoksel || bgoksel.com Vendor Homepage: http://www.ipecs.com/...

ovirt-engine: API exposes power management credentials to administrators

The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control...

Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure Exploit

Exploit for php platform in category web applications -- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem Göksel Contact: twitter.com/berkcgoksel ||...

Design/Logic Flaw

IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 store encrypted user credentials and the keystore password in cleartext in configuration files, which allows local users to...