Zyxel NAS 326 Plaintext Password Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel Hopscotch. A plaintext password vulnerability exists in Zyxel NAS 326 version 5.21 and earlier. A user with elevated privileges can exploit the vulnerability to obtain the administrator password of the device...

openSUSE Security Update : ansible (openSUSE-2019-1125)

This update for ansible to version 2.7.8 fixes the following issues : Security issues fixed: - CVE-2018-16837: Fixed an information leak in user module bsc1112959. - CVE-2018-16859: Fixed an issue which clould allow logging of password in plaintext in Windows powerShell bsc1116587. - CVE-2019-382...

CVE-2017-6047

Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication...

High-Power Hash Cracking with NPK

Password hashes are an everyday part of life in Coalfire Labs. Barring any other low-hanging fruit, its not uncommon for a penetration test to hinge on recovering a plaintext password from one of these hashes. Whether its NTLM hashes from Active Directory, NetNTLMv2 from Responder, WPA2 PMK from ...

CVE-2019-6518

CVE-2019-6518 affects Moxa IKS and EDS devices, where plaintext passwords are stored, allowing read access to sensitive credentials on devices. Connected advisories confirm affected products and versions (IKS-G6824A v5.6 and earlier; EDS-405A/408A/510A v3.8 and earlier) and describe the risk as p...

GHSA-HHXM-4F85-RGR8 High severity vulnerability that affects many_versioned_gem

Logs password in plaintext Impact Logs the password used in plaintext. The password should masked in logs to prevent it leaking. Patches Has the problem been patched? What versions should users upgrade to? Workarounds none See also Are there any links users can visit to find out more information?...

Information Disclosure

389-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as 389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the...

CVE-2018-15456

The CVE describes an authentication-validated vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) where saved passwords are inappropriately included when loading configuration pages. An attacker with read or write access to the Admin Portal can browse pages containing sensit...

PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting Vulnerability

Exploit for cgi platform in category web applications Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS Exploit Author: Kumar Saurav Reference: https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/ Vendor: ChinaMobile Category: Hardware Version...

Xiaomi Mi A1 Information Disclosure Vulnerability

The Xiaomi Mi A1 is a smartphone from Chinese company Xiaomi. An information disclosure vulnerability exists in the Xiaomi Mi A1 tissotsprout version 8.1.0, OPM version 1.171019.026, and version 9.6.4.0.ODHMIFE, which stems from the device storing plaintext Wi-Fi passwords in logcat during the...

RHEL 7 : ansible (RHSA-2018:3771)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3771 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does n...

CVE-2018-16859

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext passwor...

CVE-2018-16859

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext passwor...

CVE-2018-16859

CVE-2018-16859 affects Ansible (Windows) where PowerShell ScriptBlock logging and Module logging can expose become passwords in plaintext in Event Logs when running playbooks. A local administrator can read these logs and obtain the plaintext password. The issue was noted for Ansible Engine 2.8 a...

CVE-2018-16859

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext passwor...

CVE-2018-16859

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext passwor...

Ansible Playbooks Information Disclosure Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Playbooks is a configuration and deployment language used in Ansible. An information disclosure vulnerability exists in Ansible Playbooks. A local attacker c...

TOTOLINK A3002RU Password Disclosure Vulnerability

The TOTOLINK A3002RU is an AC1200 wireless dual-band Gigabit router. A password disclosure vulnerability exists in password.htm in TOTOLINK A3002RU version 1.0.8, which can be exploited to obtain an administrator user's password in plaintext by sending a GET request to password.htm...

389-ds-base security, bug fix, and enhancement update

1.3.8.4-15 - Bump version to 1.3.8.4-15 - Resolves: Bug 1624004 - Fix regression in last patch 1.3.8.4-14 - Bump version to 1.3.8.4-14 - Resolves: Bug 1624004 - potential denial of service attack 1.3.8.4-13 - Bump version to 1.3.8.4-13 - Resolves: Bug 1623949 - Crash in deletepasswdPolicy when...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...