Design/Logic Flaw

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

CVE-2018-11079

CVE-2018-11079 affects Dell EMC Secure Remote Services (ESRS) prior to 3.32.00.08. The vulnerability is plaintext storage of database credentials in a configuration file, allowing an authenticated user with access to that file to obtain the password and gain access to the application database. Se...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

CVE-2018-10824

An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0...

Directory traversal

An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0...

D-Link Router Password Plaintext Storage Vulnerability

The DWR-116, DIR-140, and DIR-640 are all D-Link router products. A password plaintext storage vulnerability exists in several series of D-Link routers, which stems from the administrative password being stored in plaintext in the /tmp/XXX /0 file. An attacker with directory traversal or LFI can...

D-Link Routers - Plaintext Password

D-Link Routers - Plaintext Password Password stored in plaintext CVE: CVE-2018-10824 Description: An issue was discovered on D-Link routers: DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02,...

D-Link Routers - Plaintext Password

Password stored in plaintext CVE: CVE-2018-10824 Description: An issue was discovered on D-Link routers: DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, DWR-111 through 1.01, and probably...

CVE-2018-1198

Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password...

CVE-2017-16714

In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without authentication...

Netgear DGN2200 Information Disclosure Vulnerability

NETGEAR DGN2200 is a wireless router product from NETGEAR. An information disclosure vulnerability exists in the BSWcxttongr.htm page in the Netgear DGN2200 DGN2200-V1.0.0.507.0.50 version and DGND3700 DGND3700-V1.0.0.171.0.17 version. A remote attacker can exploit this vulnerability to gain...

CVE-2018-8851

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface...

CVE-2018-8851

CVE-2018-8851 affects Echelon SmartServer 1, SmartServer 2 (before 4.11.007), i.LON 100, and i.LON 600. The root cause is unprotected storage of credentials: passwords are stored in plaintext in configuration files, enabling an attacker with access to the config to log into the SmartServer web UI...

Design/Logic Flaw

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plai...

Schneider Electric Pelco Sarix Professional 1st generation cameras authentication password disclosure vulnerability

Schneider Electric Pelco Sarix Professional 1st generation cameras is an IP camera device from Schneider Electric France. A security vulnerability exists in Schneider Electric Pelco Sarix Professional 1st generation cameras using firmware versions prior to 3.29.69. The vulnerability can be...

Security Bulletin: Password displayed in plaintext in logs (CVE-2014-0920)

Summary IBM SPSS Analytic Server jobs produce logs that contain a password in plaintext which authenticated users can view. Vulnerability Details CVEID: CVE-2014-0920 DESCRIPTION: IBM SPSS Analytic Server jobs produce logs that contain a password in plaintext which authenticated users can view...

Security Bulletin: IBM Capacity Management Analytics is affected by a plaintext password vulnerability (CVE-2015-7433)

Summary IBM Capacity Management Analytics could allow a local user on the CMA install machine to obtain other CMA user's usernames and passwords in plaintext during the CMA install. Vulnerability Details CVEID: CVE-2015-7433 DESCRIPTION: IBM Capacity Management Analytics could allow a local user ...

Microsoft Windows: MS Security Guide: WDigest Authentication

When WDigest authentication is enabled, Lsass.exe retains a copy of the user SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-7510

In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are presented in plaintext in a file that is accessible without authentication...

CVE-2017-7933

CVE-2017-7933 affects ABB IP Gateway versions 3.39 and earlier. The vulnerability arises from passwords stored in plain-text in configuration files, enabling an attacker to gain unauthorized access over the network. The issue is categorized under unprotected storage of credentials (CWE-256) and i...