U.S. Dept Of Defense: Password Cracking - Weak Password Used to Secure ████ Containing a Plaintext Password

Summary: I was able to crack the password to the ████████ located at ██████, as the pdf was protected with a weak password contained in a common word list. This guide contains steps to set-up the ███████ secure communication application with the unprotected configuration file located at██████████...

CloudBees Jenkins Zephyr Enterprise Test Management Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Zephyr Enterprise Test Management Plugin is used in one of...

Exploit for CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC !alt texthttps://github.com...

Exploit for CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHubh...

BSA-2020-1076

Security Advisory ID : BSA-2020-1076 Component : Database credentials Revision : 1.1 Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An unauthenticated malicious user with access to th...

GNOME gnome-shell password disclosure vulnerability

gnome-shell is a shell for the GNOME desktop that provides core user interface functions such as switching windows, launching applications or viewing notifications. A security vulnerability exists in GNOME gnome-shell 3.36.4 and earlier versions, which stems from the fact that if a password is se...

CVE-2020-15085 Client caching login operation with plaintext password in Saleor Storefront

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

Information Disclosure

foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...

CVE-2019-19107

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

CVE-2019-19107

CVE-2019-19107 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. Connected records describe that configuration pages for user profiles and services transfer the password in plaintext (hidden in the UI) during access, constituting an information-disclosure issue. Mul...

Information Disclosure

auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...

GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...

spring-security-core: mishandling of user passwords allows logging in with a password of NULL

A flaw was found in Spring Security in several versions, in the use of plain text passwords using the PlaintextPasswordEncoder. If an application is using an affected version of Spring Security with the PlaintextPasswordEncoder and a user has a null encoded password, an attacker can use this flaw...

CVE-2018-13313

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

Default credentials

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

CVE-2018-13313

CVE-2018-13313 affects TOTOLINK A3002RU (firmware 1.0.8). The password.htm page uses JavaScript that confirms knowledge of the current password, but the script transmits the user’s current password in plaintext, creating a confidentiality risk for users of the router. The connected documents cons...

Information Disclosure

redisson is vulnerable to information disclosure. The vulnerability exists because the generated exception message in the LogHelper file using the function LogHelper.toString with single object as argument does not obscure radis password causing the sensitive information to be logged as plaintext...

Cisco Data Center Network Manager JBoss_4_2Encrypter Hardcoded Cryptographic Key Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Data Center Network Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...