CVE-2018-13313

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

CVE-2018-13313

CVE-2018-13313 affects TOTOLINK A3002RU (firmware 1.0.8). The password.htm page uses JavaScript that confirms knowledge of the current password, but the script transmits the user’s current password in plaintext, creating a confidentiality risk for users of the router. The connected documents cons...

CVE-2018-13313 Admin Password returned in password.htm

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript...

CVE-2020-9330

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...

Default credentials

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...

CVE-2020-9330

Xerox WorkCentre printers pre-073.xxx.000.02300 are affected: changing the LDAP connector IP without revalidating credentials allows plaintext LDAP credentials to be sent to an attacker, who could gain AD access. Affected models include 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**...

CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...

Design/Logic Flaw

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...

CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...

CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of...

CVE-2013-3587

CVE-2013-3587 (BREACH) concerns TLS/SSL data compression leaks where compressed HTTPS responses reveal plaintext by observing size differences. The linked documents confirm this is a BREACH-type issue affecting HTTPS with HTTP compression, not tied to a single product. Mitigations documented incl...

Information Disclosure

redisson is vulnerable to information disclosure. The vulnerability exists because the generated exception message in the LogHelper file using the function LogHelper.toString with single object as argument does not obscure radis password causing the sensitive information to be logged as plaintext...

CVE-2014-2727

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...

Command injection

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...

CVE-2014-2727

The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...

CVE-2014-2727

The CVE-2014-2727 issue affects MailMarshal’s STARTTLS before version 7.2, enabling plaintext command injection via the STARTTLS implementation. Public sources identify this as a network‑vector vulnerability with high impact and a high score (NVD CVSS v2/v3). The root cause is the STARTTLS handli...

Opencast Encryption Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. An encryption issue vulnerability exists in Opencast versions prior to 8.1 and prior to 7.6. The vulnerability stems from a network system or product that does not properly use the relevant...

Information Disclosure

nifi-framework-core is vulnerable to information disclosure. The vulnerability exists as sensitive information is sent in plaintext to unauthenticated nodes when it tries to connect to the cluster...

IBM Security Secret Server Encryption Issue Vulnerability

IBM Security Secret Server is a set of privileged access management solutions from IBM USA. The product supports password management, privileged account identification and privileged session access monitoring and logging. An encryption issue vulnerability exists in IBM Security Secret Server. The...

CVE-2020-1942

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was...