CVE-2017-5139

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2016-9348

Summary: CVE-2016-9348 affects Moxa NPort serial device servers, where a configuration file stores passwords in plaintext. Multiple NPort models/series are affected across vendor firmware lines. Affected products (as stated): NPort 5110 (versions before 2.7), 5130/5150 series (before 3.7), 5200 (...

Honeywell XL Web II Controller plaintext stored password vulnerability (CNVD-2017-00914)

Honeywell XL Web Controller is a web-based SCADA system. A plaintext stored password vulnerability exists in Honeywell XL Web II Controller, which can be exploited by an attacker to obtain a user's password...

Phoenix Contact ILC PLC Authentication Vulnerabilities

OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contact’s ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...

Avtech IP Camera / NVR / DVR CSRF / Disclosure / Command Injection

Avtech devices multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Every Avtech device IP camera, NVR, DVR and firmware version. 4 contains the list of confirmed firmware versions, which are affected. - Product page:...

Navicat Premium 11.2.11 (64bit) Local Database Password Disclosure Vulnerability

Navicat premium is a database management tool. Navicat Premium client v11.2.11 suffers from a local password disclosure vulnerability, where the password is stored in plaintext and can be exploited to obtain the database password...

Netgear D6000 and D3600 Password Disclosure Vulnerability

The Netgear D6000 and D3600 are both wireless router products from Netgear, Inc. A password disclosure vulnerability exists in the password-recovery feature of the Netgear D6000 and D3600 using firmware version 1.0.0.49. A remote attacker can exploit the vulnerability by opening the source code o...

Accuenergy Acuvim II Series AXM-NET Module Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified authentication bypass vulnerabilities in Accuenergy’s Acuvim II Series AXM-NET module. Accuenergy has produced guidelines to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following...

eWON Plaintext Password Information Disclosure Vulnerability

eWON is an industrial router product from eWON Belgium. A security vulnerability exists in eWON using firmware versions prior to 10.1s0, which stems from a program that uses plaintext to transmit passwords. An attacker could exploit the vulnerability to obtain passwords and unauthorized access in...

Schneider Electric InduSoft Web Studio < 7.1.3.5 Local Plaintext Password Information Disclosure (SEVD-2015-100-01)

Binary data scadaindusoftwebstudioSEVD2015-100-01.nbin...

FreeBSD : rest-client -- plaintext password disclosure (ffe2d86c-07d9-11e5-9a28-001e67150279)

The open sourced vulnerability database reports : REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

openSUSE Security Update : rubygem-rest-client (openSUSE-2015-307)

rubygem-rest-client was updated to fix one security issue. The following vulnerability was fixed : - Application logging of password information in plaintext could have allowed a local attacker to gain access to this information bnc917802 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

CVE-2012-5696

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request...

CVE-2012-5696

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request...

Tridium Niagara AX Web Server < 3.5.40.3 / 3.6 < 3.6.47.3 Multiple Vulnerabilities

Binary data 8348.prm...

NETGEAR DGN2200 1.0.0.29_1.7.29_HotS - Password Disclosure

NETGEAR DGN2200 1.0.0.291.7.29HotS - Password Disclosure Exploit Title: Password Disclosure vulnerability Software: NETGEAR DGN2200 Software Link: netgear.com Version: DGN2200 Author: Dolev Farhi, email: dolevatopenflaredotorg Date: 23.7.2014 Tested on: Kali Linux Firmware 1.0.0.291.7.29HotS 2...

Aardvark Topsites 4.1 PHP Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/9231/info Multiple vulnerabilities have been identified in the software that include information disclosure, path disclosure, SQL injection, and a plaintext password weakness. Aardvark Topsites PHP version 4.1.0 has been...

RedHat 6.2 Piranha Virtual Server Package Plaintext Password Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1367/info Password changes submitted to Red Hat Piranha via HTTP are insecurely passed as variables in a GET request. Unauthorized users could obtain the password by reading the httpd access log or by sniffing...

DWebPro 3.4.1 Http.ini Plaintext Password Storage Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8438/info A vulnerability has been reported to exist in the DWebPro web server software. This problem allows an attacker to view database authentication credentials by accessing a plain text file named 'http.ini'. An...

Softbiz Classifieds PLUS Multiple SQL Injection Vulnerabilities

No description provided by source. ----------------------------Information------------------------------------------------ +Name : Softbiz Classifieds PLUS SQL Injection gallery.php +Autor : Easy Laster +Date : 25.02.2010 +Script : Softbiz Classifieds PLUS +Price : 99$ +Language : PHP +Discovered...