CVE-2022-1257

CVE-2022-1257 PoC：McAfee Agent 数据库凭据窃取 作者：scottk817 此脚本是 CVE-2022-1257 的概念验证（PoC），该漏洞存在于 McAfee Agent（Trellix Agent）操作其数据库时。该漏洞允许攻击者从 McAfee Agent 数据库文件（ma.db）中检索并解密凭据，原因是加密密钥处理不当。 免责声明 本脚本仅供教育目的使用。请勿在未拥有或未经明确授权的系统上使用 。未经授权访问系统和数据是非法且不道德的。 描述 CVE-2022-1257 由 NIST 描述如下： MA for Linux、macOS 和 Window...

Damn-Vulnerable-Bank

Damn Vulnerable Bank 指南：https://rewanthtammana.com/damn-vulnerable-bank/ 关于应用 Damn Vulnerable Bank 是一个刻意设计存在漏洞的安卓应用程序。所有细节都记录在指南中，点击此处。 即将举行的会议 NoNameCon https://cfp.nonamecon.org/nnc2021/talk/WCKLTN/ Black Hat Europe 待定 功能特性 注册 登录 个人资料界面 修改密码 设置界面（更新后端URL） 转账/查看资金前添加指纹检查 转账/查看资金前添加PIN码检查 查看余额 转账...

CVE-2022-35513

blink1-pass-decrypt ⭐ 用于对 API 服务器 /blink/input 处发现的密文进行解密的 PoC 和简单脚本， 适用于 blink1control2 安装（版本 =2.2.7）。 漏洞利用 - CVE-2022-35513 ❗ blink1control2 应用使用弱密码加密和不安全的存储方式，可通过访问 API 服务器的 /blink1/input url 发现。 其中列出了 Skype 登录和电子邮件的密码密文，并且可以被解密。 先决条件 ✔ node node argparse 模块 node simplecrypt 模块 root@kitploit:...

CVE-2024-41290

CVE-2024-41290 发现 FlatPress CMS v1.3.1 1.3 使用不安全的方法存储认证数据 附加信息： FlatPress CMS 1.3.1 版本将包括用户名和密码哈希在内的认证相关数据不安全地直接存储在客户端 Cookie 中。这种做法使敏感信息面临攻击者未经授权访问和篡改的风险。 产品厂商： 在 Cookie 中不安全地存储认证数据 受影响产品代码库： FlatPress CMS version 1.3.1 - 1.3 受影响组件： Cookie 影响： 用户名和密码哈希暴露在客户端 Cookie 中，可能被未经授权方访问或修改。 如果攻击者获得这些...

CVE-2021-38489

HDD password plaintext is stored in a UEFI variable...

EUVD-2026-67039

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

CVE-2026-81683

CVE-2026-81683 affects the openssl_encrypt Python package (pip name openssl-encrypt) versions 1.4.8 and earlier . The vulnerability is in the desktop GUI's Settings screen, where a "combined certificate and private key" PEM field stores an mTLS client private key in cleartext within a world-reada...

CVE-2026-75918

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-20705

Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...

EUVD-2026-56471

Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...

CVE-2026-20705

Insecure storage of sensitive information in the IntelR TDX module for some IntelR platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially...

CVE-2026-46513

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...

CVE-2026-14867

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability...

CVE-2026-7257

UNSUPPORTED WHEN ASSIGNED An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00ABDV.3C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file...

CVE-2025-32751

Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...

CVE-2025-32746

Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...

CVE-2025-32751

Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...

CVE-2025-32751

This CVE affects Dell PowerFlex Manager

EUVD-2025-209925

Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...

CVE-2025-32751

Dell PowerFlex Manager, versions =4.6.2, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information...