Default credentials

An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature on the application, the current password for the user is specified in plaintext. This may allow an attacker who has been authenticated to...

CVE-2017-14009

The CVE-2017-14009 vulnerability affects ProMinent MultiFLEX M10a Controller web interface. An authenticated user changing their password causes the current password to be exposed in plaintext, enabling an already-authenticated attacker to obtain the user’s password. This Information Exposure ste...

ProMinent MultiFLEX M10a Controller

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ProMinent Equipment: MultiFLEX M10a Controller Vulnerabilities: Client-Side Enforcement of Server-Side Security, Insufficient Session Expiration, Cross-Site Request Forgery, Information Exposure, and Unverified Passwo...

CVE-2010-3845

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log...

CVE-2017-11743

MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensiti...

CVE-2016-4996

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, ...

CVE-2016-4996

CVE-2016-4996 affects Foreman/Discovery-Debug: when ssh is enabled on discovered nodes, the root password is logged in plaintext to the system journal, enabling local users with journal access to read it. Impact is local; confidentiality/integrity at risk. Remediation is to apply the Red Hat Sate...

Moxa OnCell

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Moxa Equipment: OnCell Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Plaintext Storage of a Password, and Cross-Site Request Forgery AFFECTED PRODUCTS The following versions of OnCell, a...

Huawei Files Plaintext Storage Password Vulnerability

Huawei Files is a file management APP software on cell phones from Huawei China. A plaintext storage password vulnerability exists in Huawei Files 7.1.0.308 and earlier versions. An attacker can read the plaintext password information of a user's confidential cabinet by spoofing the related...

SICUNET Access Controller Multiple Vulnerabilities

SICUNET Access Controller is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2017-6528

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage the /home/dna/spool/.pfile file...

CVE-2017-6528

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage the /home/dna/spool/.pfile file...

CVE-2017-6528

CVE-2017-6528 corresponds to an insecure password storage issue in dnaLIMS 4-2015s13, where passwords are stored in clear text in the file /home/dna/spool/.pfile. The vulnerability context in the connected documents indicates this plaintext storage can be combined with other flaws (e.g., director...

CVE-2017-6528

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage the /home/dna/spool/.pfile file. Recent assessments: h00die at March 27, 2020 4:11pm UTC reported: /home/dna/spool/.pfile is the database file for users. It is a tab delimited file, and by...

SUSE-SU-2017:0475-1 Security update for susestudio

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues: - bsc968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS. - bsc947225: Second build of appliance will not register to SLMS, wrong product name. - bsc983404: UEFI boot missing for SLE11 SP...

Information Disclosure

salt is vulnerable to information disclosure. The library displays the password of a newly created user in plaintext to the user that just created a new user account...

CVE-2017-5139

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5139

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2016-9348

Summary: CVE-2016-9348 affects Moxa NPort serial device servers, where a configuration file stores passwords in plaintext. Multiple NPort models/series are affected across vendor firmware lines. Affected products (as stated): NPort 5110 (versions before 2.7), 5130/5150 series (before 3.7), 5200 (...

Honeywell XL Web II Controller plaintext stored password vulnerability (CNVD-2017-00914)

Honeywell XL Web Controller is a web-based SCADA system. A plaintext stored password vulnerability exists in Honeywell XL Web II Controller, which can be exploited by an attacker to obtain a user's password...