Privilege Escalation

WordPress is susceptible to privilege escalation attacks. The vulnerability exists due to storing wpsignups.activationkey values as plaintext in the database. It allows an attacker to hijack an unactivated user account if unauthorized database read access is gained through another attack...

CVE-2017-13771

CVE-2017-13771 affects Lexmark Scan To Network (SNF)

Lexmark Scan To Network (SNF) 3.2.9 Information Disclosure

Summary ======= 1. Information exposure of network credentials in embedded printer application CVE-2017-13771 Vendor ====== "Lexmark creates innovative imaging solutions and technologies that help customers worldwide print, secure and manage information with ease, efficiency and unmatched value...

libapache-authenhook-perl Information Disclosure Vulnerability

libapache-authenhook-perl is a package for Apache login authentication. A security vulnerability exists in libapache-authenhook-perl version 2.00-04, which stems from the program storing usernames and passwords in plaintext in the vhost error log. An attacker can exploit this vulnerability to...

Philips' DoseWise Portal Plaintext Storage Vulnerability

Philips' DoseWise Portal is a web-based reporting and tracking tool for radiation exposure. A plaintext storage vulnerability exists in Philips' DoseWise Portal. An attacker obtains text web application store login credentials in a back-end system file...

Default credentials

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

CVE-2010-3845

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

CVE-2010-3845

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

OSRAM SYLVANIA Osram Lightify Home Information Disclosure Vulnerability

OSRAM SYLVANIA Osram Lightify Home is an open IoT platform for automated control of lighting devices from German company OSRAM. A security vulnerability exists in OSRAM SYLVANIA Osram Lightify Home versions prior to 2016-07-26, which originates from the program storing the PSK in plaintext in the...

CVE-2017-7913

A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions, OnCell 5104-HSDPA, OnCell...

CVE-2017-7913

CVE-2017-7913 affects Moxa OnCell devices (G3110-HSPA/G3110-HSDPA, G3150-HSDPA, 5104-HSDPA/HSPA, 5004-HSPA). Root cause: the device configuration files store passwords in plaintext, enabling potential credential exposure. Impact stated in sources ranges from partial confidentiality loss to authen...

Detcon SiteWatch Gateway

CVSS v3 9.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Detcon Equipment: SiteWatch Gateway Vulnerabilities: Improper Authentication, Plaintext Storage of a Password AFFECTED PRODUCTS The following versions of Detcon SiteWatch Gateway, an Ethernet Notification System, are...

Security Advisory - Plaintext Storage of Users’ Safe Passwords in the Files APP in Huawei Mobile Phones

The Files APP in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak. Vulnerability ID: HWPSIRT-2017-03222 Th...

Default credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5139

CVE-2017-5139 affects Honeywell XL Web II controller family (XL1000C500 XLWebExe-2-01-00 and prior; XLWeb 500 XLWebExe-1-02-08 and prior). Root cause: plaintext storage of a password, enabling password disclosure via a specific URL. Impact per sources: remote exposure of passwords, with high-seve...

Moxa NPort Plaintext Storage Vulnerability

MOXA Nport is a serial communication server. A plaintext storage vulnerability exists in Moxa NPort. An attacker can exploit the vulnerability to launch further attacks due to parameters containing plaintext passwords...

AVTECH video surveillance equipment authentication bypass and other vulnerabilities

Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...

MicroMail Email Client for Android - Gesture Password Insecure Storage Vulnerability

Micro Mail is a multi-mailbox management mobile client, mobile office tools for personal and business users. Micro Mail Mail Client for Android - There is an insecure storage vulnerability for gesture passwords, when a user uses a gesture password, the password is stored in plaintext and can be...

Kabona AB WDC Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-17-287-07 Kabona AB WDC Vulnerabilities that was published October 13, 2016, on the NCCIC/ICS-CERT web site. Martin Jartelius and John Stock of Outpost 24 have identified vulnerabilities in Kabona AB’s...

AVTECH IP Camera, NVR, and DVR Devices - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Avtech devices multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Every Avtech device IP camera, NVR, DVR and firmware version. 4 contains the list of confirmed firmware...