CVE-2020-3929

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...

Information disclosure

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...

Philips IntelliBridge Enterprise Log Information Disclosure Vulnerability

Philips IntelliBridge Enterprise IBE is a solution from Philips in the Netherlands that provides a single point of contact between EHRs electronic health records and Philips clinical solutions. A log information disclosure vulnerability exists in Philips IBE B.12 and earlier versions that can be...

SAP Business One Information Disclosure Vulnerability (CNVD-2020-53124)

SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. A security vulnerability exists in the backup service in SAP Business One versions 9.3 and 10.0. An attacker cou...

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin allows a hacker to obtain user credentials.

The vulnerability of the org.jfrog.hudson.ArtifactoryBuilder.xml component of the Jenkins Artifactory Plugin involves the transmission of confidential information in open text. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user credentials...

rConfig SQL Injection Vulnerability (CNVD-2020-38217)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38219)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38218)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38220)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

Nextcloud -- Password share by mail not hashed

The Nextcloud project reports: NC-SA-2020-026 low: Password of share by mail is not hashed when given on the create share call A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call...

Password of share by mail is not hashed when given on the create share call (NC-SA-2020-026)

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call...

D-Link DIR-865L Information Disclosure Vulnerability (CNVD-2020-33169)

The D-Link DIR-865L is a wireless router from AUO D-Link of Taiwan, China. An information disclosure vulnerability exists in D-Link DIR-865L Ax version 1.20B01 Beta, which originates from the program storing sensitive information in plaintext form. An attacker can exploit this vulnerability to...

Nextcloud: The password of a mail share is not hashed if the password is given when the share is created

Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Check the...

Unspecified vulnerability in COVIDSafe app

COVIDSafe app is an Australian coronavirus contact tracing app. The COVIDSafe app suffers from an unspecified vulnerability that stems from an unnecessary field in the OpenTrace/BlueTrace protocol. An attacker can exploit the vulnerability by looking at plaintext payload data to confirm the model...

Information Disclosure

foreman is vulnerable to information disclosure. The delete compute resource operation allows for the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the deletecomputeresource permission is able to exploit the vulnerability to take control ov...

Information Disclosure

spring-security-core is vulnerable to Information Disclosure. The vulnerability exists as it uses a fixed null initialization vector with CBC Mode for the queryable text encryptor rather than handling the null value passed to the function BCryptPasswordEncoder.encode, thereby allowing a user with...

Kubernetes: Plaintext storage of a password on kubernetes release bucket

Report Submission Form Summary: During my recon I found these two buckets dl.k8s.io and dl.kubernetes.io which actually redirects to https://storage.googleapis.com/kubernetes-release/. By searching the string "password" under https://storage.googleapis.com/kubernetes-release/ I found a file calle...

Unspecified Vulnerability in Blaauw Remote Kiln Control (CNVD-2020-28486)

The Blaauw Remote Kiln Control is an automated ceramic kiln controller from Blaauw in the Netherlands. An unspecified vulnerability exists in Blaauw Remote Kiln Control. An attacker can exploit this vulnerability to access MySQL credentials in plaintext in /engine/db.inc, /lang/nl.bak, or...

Wavlink WL-WN530HG4 Information Disclosure Vulnerability (CNVD-2020-41784)

WAVLINK WL-WN530HG4 is a wireless network signal extender from China RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WL-WN530HG4 M30HG4.V5030.191116 version. The vulnerability can be exploited by an attacker to obtain the current administrator password in plaintext form in t...

HCL Technologies Nomad Information Disclosure Vulnerability

HCL Technologies Nomad is an application from HCL Technologies India for using, managing Domino application development platform in mobile devices. A security vulnerability exists in HCL Technologies Nomad for Android and iOS platforms, which stems from the fact that the software communicates in...