Information disclosure

The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext...

CVE-2022-24660

CVE-2022-24660 affects Goldshell ASIC Miners (v2.2.1 and earlier). The root cause is a debug interface exposed publicly via the web interface, enabling attackers to access passwords and other sensitive information in plaintext. The CVE entry notes network attack potential with high impact to conf...

Zimbra Collaboration Suite 安全漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Zimbra in the United States. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite version 8.8.15, which stems from not encrypting a randomly created...

AutomationDirect DirectLOGIC 安全漏洞

AutomationDirect DirectLOGIC is a programmable logic controller from AutomationDirect, Inc. A security vulnerability exists in AutomationDirect DirectLOGIC that originates from an attack by a specially crafted serial message sent to the CPU serial port that causes the PLC to respond to the PLC...

CVE-2022-23236

E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessible only to privileged users...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1763)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-Q9G8-9HPP-XC82 ActiveMQ Artemis has Insufficiently Protected Credentials

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

Password in config file in KIE server

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services...

Security Bulletin: IBM MQ for HP NonStop Server is affected by vulnerability CVE-2022-22325

Summary A queue manager trace may disclose a plaintext password flowing over an MQ channel. The issue is described by CVE-2022-22325 Vulnerability Details CVEID: CVE-2022-22325 DESCRIPTION: IBM MQ can inadvertently disclose sensitive information under certain circumstances to a local user from a...

Default credentials

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application stores the PBKDF2 derived key of users passwords with a low...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1675)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-2124

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. Mitigation Ensure the following global smb.conf parameters are set to their default values as show...

Strapi 3.6.8 Password Disclosure / Insecure Handling

Exploit Title: Strapi " Date: 2022-03-30 Exploit Author: Kitchaphan Singchai idealphase Vendor Homepage: https://strapi.io/ Software Link: https://github.com/strapi/strapi/releases Vulnerable Version: ..SNIP.. Redirecting to /documentati...

Backdoor.Win32.Psychward.03.a Weak Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/d069738f18957117367b8a79195a6a96.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Psychward.03.a Vulnerability: Weak Hardcoded Password Description: The malware listen...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-1413)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-32982

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...

Unspecified Vulnerability in 3CX Phone System

The 3CX Phone is a software-based private branch exchange. It can be used with SIP standard based IP phones, SIP trunks and VoIP gateways to provide a complete communication solution. A security vulnerability exists in the 3CX Phone System that stems from the 3CX Phone System storing passwords in...

CVE-2020-25184 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could...

BuilderOrcus Insecure Credential Storage

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/cc3670f1b3e60e00b43c86d787563a44B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: BuilderOrcus Orcus.Administration-cracked.exe Vulnerability: Insecure Credential Storage Descriptio...

AlmaLinux 8 : samba (ALSA-2021:5082)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5082 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire...