1024 matches found
VICIdial 2.14-917a SQL Injection Vulnerability
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial version 2.14-917a to enumerate database records. By default, VICIdial stores plaintext credentials within the database. Title: VICIdial Unauthenticated SQL Injection Publication URL:...
CVE-2024-8503
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database...
CVE-2024-8503 VICIdial Unauthenticated SQL Injection
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database...
CVE-2024-8503
CVE-2024-8503 (SQL Injection) in VICIdial: an unauthenticated attacker can trigger a time-based SQL injection to enumerate database records and expose plaintext credentials stored in VICIdial. Connected documents corroborate a critical impact (C<H/I<H/A
VICIdial Unauthenticated SQL Injection
Vulnerability Details Affected Vendor: VICIdial Affected Product: VICIdial Affected Version: 2.14-917a Platform: GNU/Linux CWE Classification: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CVE ID: CVE-2024-8503 2. Vulnerability Description An...
PT-2024-29471 · Texas Instruments · Texas Instruments Fusion Digital Power Designer
Name of the Vulnerable Software and Affected Versions: Texas Instruments Fusion Digital Power Designer version 7.10.1 Description: The issue allows a local attacker to obtain sensitive information via the plaintext storage of credentials. This is due to insufficiently protected credentials in the...
Pulse Secure VPN Arbitrary File Disclosure
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pulse Secure VPN Arbitrary File Disclosure', 'Description' = %q This module exploits a pre-auth directory traversal in the Pulse Secure VPN serve...
Siemens Omnivise T3000 安全漏洞
The Omnivise T3000 is a distributed control system for fossil fuel and large renewable energy power plants. A sensitive information plaintext storage vulnerability exists in the Siemens Omnivise T3000 Application Server due to an affected device storing initial system credentials without adequate...
CVE-2024-41954
Summary: CVE-2024-41954 affects FOGProject. The vulnerable component is the /opt/fog/.fogsettings file, which stores plaintext service account credentials and is readable by all users on the host. Exploitation of these credentials could allow a malicious user to create new web-application account...
CVE-2024-41954 FOG Weak file permissions
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accoun...
PT-2024-29662 · Fog · Fog
Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10.41 Description: The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file, which is readable by all users on the host. This allows a malicious user to exploit these...
SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34375)
The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...
FOGProject 安全漏洞
FOGProject is a free open source network computer cloning and management solution from FOGProject Open Source. It can be used to deploy and manage any desktop operating system. A security vulnerability exists in FOGProject that stems from storing plaintext service account credentials in the...
SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34379)
The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that originates from storing default username and password credentials in plaintext in the router firmware/database. An attacker could exploit...
CVE-2024-41691
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary...
CVE-2024-41688
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the...
PT-2024-29509 · Syrotech · Sy-Gpon-1110-Wdont Router
Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the unencrypted storage of WPA/WPS credentials within the router's firmware/database. An attacker with physical access could exploit this...
SyroTech SY-GPON-1110-WDONT 安全漏洞
The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...
PT-2024-29512 · Syrotech · Sy-Gpon-1110-Wdont Router
Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the storage of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with...