CVE-2020-16244: Use of a One-Way Hash without a Salt

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

PT-2020-14837

Name of the Vulnerable Software and Affected Versions GE Digital APM Classic versions 4.4 and prior Description The issue is related to a design flaw where salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This, combined with an IDOR vulnerability, puts...

Easergy Builder Hardcoded Encryption Key Plaintext Storage Vulnerability

Schneider Electric Easergy Builder is a set of configuration software for Easergy remote terminal units and controllers from Schneider Electric, France. A security vulnerability exists in Schneider Electric Easergy Builder version 1.4.7.2 and prior versions. An attacker could exploit the...

CVE-2020-7515

A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to decrypt a password...

CVE-2020-7515

A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to decrypt a password...

CVE-2020-7515

A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to decrypt a password...

CVE-2020-7515

CVE-2020-7515 affects Schneider Electric’s Easergy Builder (V1.4.7.2 and older). The root cause is a CWE-321 issue: a hard-coded cryptographic key stored in cleartext, which could allow an attacker to decrypt a password. Documents from multiple sources (NVD, Red Hat, CNVD, PRION, CVE listings) co...

SOS JobScheduler 1.13.3 - Stored Password Decryption Exploit

Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption Exploit Author: Sander Ubink Vendor Homepage: www.sos-berlin.com Software Link: www.sos-berlin.com/en/jobscheduler-downloads Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13 Tested on: Windows and Linux CVE:...

SOS JobScheduler 1.13.3 Stored Password Decryption

Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption Google Dork: N/A Date: 2020-04-20 Exploit Author: Sander Ubink Vendor Homepage: www.sos-berlin.com Software Link: www.sos-berlin.com/en/jobscheduler-downloads Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13...

SOS JobScheduler 1.13.3 - Stored Password Decryption

Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption Google Dork: N/A Date: 2020-04-20 Exploit Author: Sander Ubink Vendor Homepage: www.sos-berlin.com Software Link: www.sos-berlin.com/en/jobscheduler-downloads Version: Tested on 1.12.9 and 1.13.3, vendor reported 1.12 and 1.13...

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

PT-2020-13221

Name of the Vulnerable Software and Affected Versions SOS JobScheduler versions 1.12 through 1.13 Description The issue is related to insecure user/password encryption in the JOE component, allowing attackers to decrypt the stored user/password. Recommendations For SOS JobScheduler versions 1.12...

The vulnerability of the Schneider Electric Easergy Builder software in terms of controller configuration lies in the use and storage of the cryptographic key in an unencrypted form. This allows a hacker to decrypt user passwords.

The vulnerability of the Schneider Electric Easergy Builder software for configuring controllers is related to the use and storage of the cryptographic key in an unencrypted form. Exploiting this vulnerability could allow a hacker to decrypt user passwords...

SUSE SLES12 Security Update : pam_radius (SUSE-SU-2020:1117-1)

This update for pamradius fixes the following issues : CVE-2015-9542: Fixed a buffer overflow in password field bsc1163933. On s390x didn't decrypt passwords correctly bsc1141670. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

CVE-2019-19299: Inadequate Encryption Strength

A vulnerability has been identified in SiNVR/SiVMS Video Server All versions = V5.0.0 = V5.0.2. The streaming service default port 5410/tcp of the SiVMS/SiNVR Video Server applies weak cryptography when exposing device camera passwords. This could allow an unauthenticated remote attacker to read...

CVE-2019-18988: Weak Password Requirements

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the...

Unspecified Vulnerability in ZyXEL GS1900 (CNVD-2019-41670)

ZyXEL GS1900 is a managed switch from ZyXEL Taiwan, China. A security vulnerability exists in the Zyxel GS1900 using firmware prior to this version 2.50AAHH.0C0. An attacker could exploit the vulnerability to decrypt a previously encrypted password...

ZyXEL GS1900 Use of Hardcoded Passwords Vulnerability

ZyXEL GS1900 is a managed switch from ZyXEL Taiwan, China. A security vulnerability exists in the Zyxel GS1900 using firmware prior to version 2.50AAHH.0C0. The vulnerability can be exploited by an attacker to decrypt passwords with the help of hard-coded encryption keys...

Broadcom Brocade SANnav Encryption Issue Vulnerability

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in the encryption key generation process in the PBE algorithm of Broadcom Brocade SANnav versions prior to 2.0. An attacker can exploit this vulnerability to decrypt passwords...

CVE-2019-15799

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH while their...