CVE-2018-13992

The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission HTTP of user credentials by default...

Sierra Wireless AirLink ES450 Information Disclosure Vulnerability

The Sierra Wireless AirLink ES450 is a cellular network modem device from Sierra Wireless Canada. An information disclosure vulnerability exists in the ACEManager authentication feature in the Sierra Wireless AirLink ES450 using firmware version 4.9.3, which can be exploited by an attacker to sni...

CVE-2019-0032

A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...

PT-2019-11693 · Jenkins · Jenkins Netsparker Cloud Scan Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Netsparker Cloud Scan Plugin version 1.1.5 and older Jenkins Netsparker Enterprise Scan Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in plain text within configuration fil...

CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

MarcomCentral FusionPro VDP Creator Path Traversal Vulnerability

MarcomCentral FusionPro VDP Creator is a variable data publishing design and layout tool from MarcomCentral USA. A directory traversal vulnerability exists in the FPProducerInternetServer.exe service/utility in MarcomCentral FusionPro VDP Creator versions prior to 10.0. A remote attacker could us...

Ansible User Module Information Disclosure Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and organize computer systems.User module is one of the user modules. An information disclosure vulnerability exists in the User module in Ansible. The vulnerability can be exploited by an...

Unprotected VOIP Server Exposed Millions of SMS Messages, Call Logs

A California-based Voice-Over-IP VoIP services provider VOIPO has accidentally left tens of gigabytes of its customer data, containing millions of call logs, SMS/MMS messages, and plaintext internal system credentials, publicly accessible to anyone without authentication. VOIPo is one of a leadin...

CloudBees Jenkins Artifactory Plugin Disk Unencryption Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor ongoing software releases/testing projects and some timed tasks.Artifactory Plugin is a plugin that is used to release, parse and Publish traceable bui...

Authorization

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource...

CVE-2018-17245

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource...

Versa Networks: Plaintext Credentials in Backups & Configs

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for various application components such as SNMP, and SSL and Trust keystores...

Information Disclosure

kibana is vulnerable to information disclosure attacks. The vulnerability exists as plaintext credentials are being sent in the HTTP request during the PDF generation process, allowing an external resource provider to view the credentials...

CVE-2018-17922

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2018-24842)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A security vulnerability exists in IBM Security Guardium version 10.5...

Puppet Enterprise Plaintext Transfer Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A plaintext transfer vulnerability...

CVE-2018-11749

CVE-2018-11749 affects Puppet Enterprise when startTLS with RBAC LDAP is configured; at login time, user credentials are sent in plaintext to the LDAP server. Affected PE versions: 2018.1.3, 2017.3.9, and 2016.4.14. Fixes are available in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. Seve...

CVE-2018-11749

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS...

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines Information Disclosure Vulnerability

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines are both products of Dell Dell. The former is a suite of disaster recovery and data protection software, and the latter is a disaster recovery solution for VMware environments. An information disclosure vulnerability exists in Dell EMC...