CVE-2018-10024

The vulnerability CVE-2018-10024 affects UbiQuoss Switch VP5208A. On a failed login attempt, the device creates a bcm_password file at /cgi-bin/ containing user credentials in cleartext, which can be retrieved via an HTTP request. These credentials can be used to access the system via SSH (or TEL...

CVE-2015-1957

IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-in-the-middle attack, related to duplication of message data in cleartext outside the protected payload. IBM X-Force ID: 103482...

CVE-2014-2359

OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data...

Design/Logic Flaw

OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data...

CVE-2014-2359

OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data...

Default credentials

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other...

Hardcoded credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

PYSEC-2018-101

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

PYSEC-2018-101

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...

CVE-2018-9160

SickRage before v2018.03.09-1 exposes credentials in plaintext via HTTP responses, allowing an attacker to view saved GitHub (and other) credentials. The root cause is that HTTP responses leak sensitive data. Affected are SickRage installations prior to 2018.03.09-1. Remediation: upgrade to v2018...

Default credentials

An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response specifically, the configuration file restoredefault, which is...

CVE-2015-7433

IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107862...

CVE-2015-7433

IBM Capacity Management Analytics 2.1.0.0 is affected by CVE-2015-7433, where a local attacker on the CMA install machine can obtain other CMA users’ usernames and plaintext passwords during installation. The issue arises from insecure handling during the CMA install process. The IBM security bul...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

Default credentials

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...