CVE-2021-42370

The CVE-2021-42370 entry concerns XoruX LPAR2RRD and STOR2RRD prior to version 7.30 where cleartext passwords are exposed in HTML password input fields in device properties, enabling information disclosure. The vulnerability stems from password mismanagement in the UI layer. The available documen...

The vulnerability of the Fly-wm window manager, related to the disclosure of information, allows attackers to gain access to confidential data.

The vulnerability of the Fly-wm window manager is related to the disclosure of information during password input from a locked session. Exploiting this vulnerability allows an attacker to gain access to confidential data...

SourceCodester Water Billing System SQL Injection Vulnerability

SourceCodester Water Billing System is a water billing system from SourceCodester USA. A SQL injection vulnerability exists in SourceCodester Water Billing System version 1.0, which stems from a failure of the program to properly validate user input, and allows an attacker to perform SQL injectio...

CVE-2020-15671

When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android 80...

Possible denial of service when entering a long password (NC-SA-2020-028)

Improper check of inputs in Preferred providers app 1.6.0 allowed to perform a denial of service attack when using a very long password...

SUDO_KILLER - A Tool To Identify And Exploit Sudo Rules' Misconfigurations And Vulnerabilities Within Sudo

Linux Privilege Escalation through SUDO abuse. If you like the tool and for my personal motivation so as to develop other tools please a +1 star The tool can be used by pentesters, system admins, CTF players, students, System Auditors and trolls :. INTRO WARNING: SUDOKILLER is part of the KILLER...

Information Disclosure

ansible is vulnerable to Information Disclosure. The library does not wrap the password input properly, thus allowing an attacker to enter a password with special character to expose information in the template...

Samsung SmartThings Hub STH-ETH-250 video-core HTTP server buffer overflow vulnerability (CNVD-2018-19739)

Samsung SmartThings Hub STH-ETH-250 is a smart home management device from Samsung, South Korea. video-core HTTP server is one of the HTTP servers. A buffer overflow vulnerability exists in the Samsung WifiScan handler for the video-core HTTP server in the Samsung SmartThings Hub STH-ETH-250 with...

CVE-2018-1075

A flaw was found in ovirt-engine. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords...

Login Authentication Bypass Vulnerability in SoftCMS System

SoftCMS is a large-scale video surveillance management system from Moxa Moxa Technology. A security bypass vulnerability exists in SoftCMS version 1.5 in the password input field of the user login page, which can be exploited by attackers to bypass user authentication and login the system...

The vulnerability of the D-Link DSR-150 router’s microprogramming software allows a malicious individual to gain administrator privileges.

The script “/scgi-bin/platform.cgi” of the D–Link DSR–150 router’s software does not properly filter the data entered by the user in the “Password” field. As a result, a malicious individual can bypass the authentication process and gain access to the device with administrator privileges...

Grub2 Integer Overflow Vulnerability

GNU GRUB is a set of bootloaders for the GNU Project developed by the GNU Project.Grub2 is an enhanced version of it. A security vulnerability exists in the handling of backspace characters in the 'grubusernameget' function in the grub2 grub-core/normal/auth.c file and the 'grubpasswordget '...

Apple iOS Webkit Password Input Context Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in Apple iOS's handling of password entry contexts allows an attacker to construct a malicious WEB page and trick users into parsing it to obtain the last digit of sensitive...

Ninja 0.1.3 Race Condition

Title Ninja privilege escalation detection and prevention system race condition Author Ben 'highjack' Sheppard URL http://highjack.github.io/ Description There is a small delay between the time of execution of a command and the time privelege escalation is detected. It is therefore possible to us...

CVE-2014-9218

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service resource consumption via a long password...

Acc PHP eMail 1.1 - CSRF

No description provided by source. /\ == \ /\ \ /\ \ \ \ \ \ \ \ \ /\ \ \ \ \ \ \ \ // // // 01000010 01101001 01001111 ---------------------------------------------------------------- + Acc PHP eMail v1.1 - CSRF // Author Info x Author: bi0 x Contact: [email protected] x Homepage :...

Mail.ru: (m.mail.ru) Password type input with auto-complete enabled

Password type input with auto complete enabled Vulnerability description: When a new name and password is entered in a form and the form is submitted, the browser asks if the password should be saved. Thereafter when the form is displayed, the name and password are filled in automatically or are...

Safari < 6.0 Multiple Vulnerabilities

Binary data 800986.prm...

Interspire Shopping Cart v6 - Multiple Web Vulnerabilities

Title: ====== Interspire Shopping Cart v6 - Multiple Web Vulnerabilities Date: ===== 2012-06-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=593 VL-ID: ===== 593 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

CVE-2011-4736

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in loginup.php3 and certain other files...