CVE-2015-8335

Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated users to obtain sensitive information by triggering log generation and then reading the log...

CVE-2015-8335

Huawei VCN500 (software prior to V100R002C00SPC201) stores user passwords in plaintext in logs, enabling remote authenticated users to obtain sensitive information by triggering log generation and reading the logs. The issue is caused by plaintext password logging in the device’s logging mechanis...

IRC Daemon STARTTLS Command Support

The remote IRC daemon supports the use of the 'STARTTLS' command to switch from a cleartext to an encrypted communications channel. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid87817; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

ACAP Cleartext Authentication

The remote Automated Content Access Protocol ACAP service supports one or more authentication mechanisms that allow credentials to be sent in the clear. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid87732; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date:...

XMPP Cleartext Authentication

The remote Extensible Messaging and Presence Protocol XMPP service supports one or more authentication mechanisms that allow credentials to be sent in the clear. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid87736; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date...

AMQP Cleartext Authentication

The remote Advanced Message Queuing Protocol AMQP service supports one or more authentication mechanisms that allow credentials to be sent in the clear. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid87733; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date:...

SMB Password Encryption Not Required

The remote SMB server does not require password encryption. This allows clients to send cleartext passwords over the network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid87734; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2016/01/05 18:44:51 $";...

Subversion Cleartext Authentication

The remote Subversion SVN service supports one or more authentication mechanisms that allow credentials to be sent in the clear. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid87735; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2016/01/05 18:44:51 $";...

CVE-2015-7438

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access...

Design/Logic Flaw

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access...

CVE-2015-7438

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access...

CVE-2015-8838

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, that was published March 26, 2015, to the NCCIC/ICS-CERT web site. Gleb Gritsai, Ilya Karpov, and Kirill Nesterov o...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities

OVERVIEW Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and independent researcher Alisa Esage Shevchenko have identified vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patch...

CVE-2015-8253

The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive 1 message or 2 MJPEG video data by sniffing the network...

CVE-2015-8252

The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number...

Hardcoded credentials

The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number...

Code injection

The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive 1 message or 2 MJPEG video data by sniffing the network...

CVE-2015-8253

The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive 1 message or 2 MJPEG video data by sniffing the network...

CVE-2015-8253

CVE-2015-8253 affects RSI Video Technologies Videofied Frontel protocol (pre-3) where initial AES authentication is followed by unencrypted traffic. The vulnerability allows a remote attacker to sniff plaintext messages and MJPEG video data, exposing sensitive information. The issue is rooted in ...