FortiOS Path Traversal Credential Gatherer

Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...

CVE-2021-21546

Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. A local low-privileged user of the Networker server could potentially exploit this vulnerability to read plain-text credentials from server log files...

SmartFoxServer Information Disclosure Vulnerability

SmartFoxServer is a software development program for rapid development of multiplayer games and applications via Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal Windows Platform, Android, Java, C ++, etc. SmartFoxServer is a software development program from SmartFoxServer, USA. The software...

Fiber Encryption Problem Vulnerability

Fiber is an open source web framework written in the Go language . An encryption issue vulnerability exists in FiberHome HG6245D, which can be exploited by an attacker to find passwords and authentication cookies stored in plaintext on the device...

CVE-2021-3252

KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure...

CVE-2021-3252

KACO New Energy XP100U up to XP-JAVA 2.0 is affected by an information-disclosure vulnerability caused by incorrect access control during the authentication process, which results in credentials being returned in plain-text from the local server. The CVE entry (CVE-2021-3252) is corroborated by m...

KACO new energy GmbH KACO XP100U Security Vulnerability

KACO new energy GmbH KACO XP100U is an application from KACO new energy GmbH, Germany, that provides new energy conversion. A security vulnerability exists in KACO New Energy XP100U Up to XP-JAVA 2.0, which stems from credentials always being returned in plaintext from the local server, regardles...

IBM Security Verify Information Queue User Credentials Sent in Plaintext Vulnerability

IBM Security Verify Information Queue is a cross-product integrator that leverages Kafka technology and a publish/subscribe model to integrate data between IBM security products. IBM Security Verify Information Queue suffers from a user credentials plaintext delivery vulnerability. An attacker...

FiberHome HG6245D Password Plaintext Storage Vulnerability

The HG6245D is an FTTH ONT router from FiberHome. The FiberHome HG6245D suffers from a password plaintext storage vulnerability. An attacker can exploit this vulnerability to obtain passwords in plaintext...

TP-Link Archer C5v Information Disclosure Vulnerability

The TP-Link Archer C5v is an AC1200 wireless dual-band Gigabit VoIP router. An information disclosure vulnerability exists in TP-Link Archer C5v 1.7181221. A remote attacker can exploit this vulnerability by sending a USERCFG0,0,0,0,0,0,0,00,0,0,0,00,0 request to the /cgi?1&5 URI to retrieve...

Schneider PowerLogic Product Information Disclosure Vulnerability

Schneider PowerLogic is an industrial control device from Schneider China. Provides increased power factor to improve power quality and troubleshoot power failures to protect networks, devices and operators. An information disclosure vulnerability exists in multiple Schneider PowerLogic products...

Agora Agora Video SDK Information Disclosure Vulnerability

Agora Agora Video SDK is an application from the American company Agora. It provides a feature to add real-time audio and video interaction to games, increasing the interactive features between players. An information disclosure vulnerability exists in the Agora Video SDK, which stems from a...

Tesla SolarCity Solar Monitoring Gateway Trust Management Issue Vulnerability

Tesla SolarCity Solar Monitoring Gateway is an application from Tesla SolarCity Solar Monitoring Gateway Tesla, USA. Solar equipment is provided. A security vulnerability exists in Tesla SolarCity Solar Monitoring Gateway through 5.46.43, which stems from the use of hardcoded credentials Digi...

Mutare Voice Security Feature Issue Vulnerability

A security signature issue vulnerability exists in Mutare Voice EVM 3.x before 3.3.8, which originates when password information is displayed in plaintext on an external system...

CVE-2021-20410

IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190...

CVE-2021-20408

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187...

Information disclosure

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187...

CVE-2021-20410

IBM Security Verify Information Queue (ISIQ) versions 1.0.6 and 1.0.7 expose InfluxDB credentials via a logs stack YAML configuration, allowing an authenticated user to read credentials over the network through MITM. The issue is documented under CVE-2021-20410, with remediation advising customer...

CVE-2021-20408

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext cryptographic key. IBM X-Force ID: 198187...

Secret Chat in Telegram Left Self-Destructing Media Files On Devices

Popular messaging app Telegram fixed a privacy-defeating bug in its macOS app that made it possible to access self-destructing audio and video messages long after they disappeared from secret chats. The vulnerability was discovered by security researcher Dhiraj Mishra in version 7.3 of the app, w...