Cross site request forgery (csrf)

An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker with network access to the device to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single...

CVE-2020-28946

An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker with network access to the device to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single...

CVE-2020-28946

The CVE-2020-28946 entry concerns Plum IK-401 devices with firmware prior to 1.02. The issue is an improper webserver configuration that, when the device is reachable over the network, allows unauthenticated retrieval of the configuration file, including hashed credential data, via a single GET r...

CVE-2020-28946: Missing Authentication for Critical Function

An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker with network access to the device to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single...

PT-2020-17068

Name of the Vulnerable Software and Affected Versions Plum IK-401 devices with firmware before 1.02 Description The issue is related to an improper webserver configuration, allowing an attacker with network access to the device to obtain the configuration file, including hashed credential data,...

Plum Ik-401 访问控制错误漏洞

The Plum Ik-401 is a 4G modem/router from Plum Germany for use in industrial environments. A security vulnerability exists in Plum IK-401 versions prior to 1.02, which can be exploited by an attacker accessing the device over the network to obtain a configuration file, including hashed credential...

VMware Horizon View Client < 5.5.0 Information Disclosure (VMSA-2020-0024)

The version of VMware Horizon Client for Windows installed on the remote host is less than 5.5.0. It is, therefore, affected by an information disclosure vulnerability due to incorrect validation of user input. A malicious attacker with local privileges on the machine where Horizon Client for...

Barco wePresent Hardcoded API Credentials

Vulnerability Details Affected Vendor: Barco Affected Product: wePresent WiPG-1600W Affected Version: 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19 Platform: Embedded Linux CWE Classification: CWE-798: Use of Hard-coded Credentials CVE ID: CVE-2020-28329 2. Vulnerability Description Barco wePresent...

CVE-2020-27693

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA 9.1 stores administrative passwords using a hash that is considered outdated...

VMware Horizon Client for Windows Information Disclosure Vulnerability

VMware Horizon Client is a client application for connecting to VMware Horizon virtual desktops from VMware. An information disclosure vulnerability exists in VMware Horizon Client for Windows 5.x series versions prior to 5.5.0, which can be exploited by an attacker to retrieve hashed credentials...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

Information disclosure

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3998: Undefined Security Weakness

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

PT-2020-4715

Name of the Vulnerable Software and Affected Versions: VMware Horizon Client for Windows versions 5.x prior to 5.5.0 Description: The issue is related to insufficient protection of registration data, which may allow a malicious attacker to gain unauthorized access to protected information...

Design/Logic Flaw

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the...

FreeBSD : Nextcloud -- Password share by mail not hashed (eeec4e6f-fa71-11ea-9bb7-d4c9ef517024)

The Nextcloud project reports : NC-SA-2020-026 low: Password of share by mail is not hashed when given on the create share call A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. C Tenable Network Security,...

CVE-2020-13699

TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: —play URL. An attacker could force a victim to send an NTLM authentication request and either rel...

CVE-2020-3450

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative credentials to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted...