8952 matches found
CVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. Recent assessments: theguly at March 12, 2020 3:39pm UTC reported: i love these type of vulnerabilities because they chain three findings normally...
Information Disclosure
nova is vulnerable to information disclosure. The vulnerability exists as the novncproxy tokens are logged in plaintext when it is sent through the web socket proxy...
Moxa EDS-G516E and EDS-510E series plaintext transfer vulnerability
Moxa EDS-G516E and EDS-510E series are both Ethernet switches manufactured by Moxa. A plaintext transfer vulnerability exists in the Moxa EDS-G516E and EDS-510E series, which can be exploited by attackers to obtain sensitive information...
Multiple Moxa Products Plaintext Transfer Vulnerability
Moxa MB3170/MB3270/MB3180/MB3280/MB3480/MB3660 series is an advanced Ethernet gateway device manufactured by moxa Taiwan. An information disclosure vulnerability exists in multiple Moxa products, which can be exploited by attackers to obtain sensitive information...
CVE-2018-13313
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...
Default credentials
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...
CVE-2018-13313
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...
CVE-2018-13313
CVE-2018-13313 affects TOTOLINK A3002RU (firmware 1.0.8). The password.htm page uses JavaScript that confirms knowledge of the current password, but the script transmits the user’s current password in plaintext, creating a confidentiality risk for users of the router. The connected documents cons...
CVE-2018-13313 Admin Password returned in password.htm
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...
CVE-2020-9330
Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...
Default credentials
Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...
CVE-2020-9330
Xerox WorkCentre printers pre-073.xxx.000.02300 are affected: changing the LDAP connector IP without revalidating credentials allows plaintext LDAP credentials to be sent to an attacker, who could gain AD access. Affected models include 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**...
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...
Design/Logic Flaw
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...
CVE-2013-3587
CVE-2013-3587 (BREACH) concerns TLS/SSL data compression leaks where compressed HTTPS responses reveal plaintext by observing size differences. The linked documents confirm this is a BREACH-type issue affecting HTTPS with HTTP compression, not tied to a single product. Mitigations documented incl...
Information Disclosure
redisson is vulnerable to information disclosure. The vulnerability exists because the generated exception message in the LogHelper file using the function LogHelper.toString with single object as argument does not obscure radis password causing the sensitive information to be logged as plaintext...