CVE-2022-27544

BigFix Web Reports authorized users may see SMTP credentials in clear text...

Design/Logic Flaw

BigFix Web Reports authorized users may see SMTP credentials in clear text...

CVE-2022-27544 HCL BigFix Web Reports authorized users may see sensitive information in clear text

BigFix Web Reports authorized users may see SMTP credentials in clear text...

CVE-2022-27544: Insufficiently Protected Credentials

BigFix Web Reports authorized users may see SMTP credentials in clear text...

PT-2022-18475

Name of the Vulnerable Software and Affected Versions BigFix Web Reports affected versions not specified Description The issue allows authorized users of BigFix Web Reports to see SMTP credentials in clear text. Recommendations At the moment, there is no information about a newer version that...

HCL BigFix Platform 安全漏洞

HCL Technologies HCL BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform versions 9.5 to 9.5.19,...

CVE-2022-27544

BigFix Web Reports authorized users may see SMTP credentials in clear text...

YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ user an...

YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them PoC Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ use...

PT-2021-24168

Name of the Vulnerable Software and Affected Versions: Dalmark Systems Systeam version 2.22.8 build 1724 Description: The Systeam application, an ERP system with a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts, has a broken...

CVE-2021-44877: Undefined Security Weakness

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

CVE-2021-22781

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

CVE-2021-22781

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

PT-2021-7777

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert versions prior to V15.0 SP1 EcoStruxure Process Expert all versions SCADAPack RemoteConnect for x70 all versions Description The issue is related to insufficiently protected credentials, which could lead to a leak of...

MTN Group: PHP Info Exposing Secrets at https://radio.mtn.bj/info

Summary: During recon I discovered a PHP Info file exposing environment variables such as; Laravel APPKEY, Database username/password, SMTP username/password, etc. Steps To Reproduce: Visit the following URL; https://radio.mtn.bj/info You will be presented with a PHP Info file exposing environmen...

Castel NextGen DVR Administrator Creation Vulnerability

Castel NextGen DVR is a network video device. A security vulnerability exists in Castel NextGen DVR that allows remote attackers to exploit the vulnerability by submitting a special request that could create an administrator user or obtain SMTP authentication credentials...

CVE-2020-11681

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...

CVE-2020-11681

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials...

CVE-2020-11681

Castel NextGen DVR v1.0.0 stores and displays credentials for the SMTP server in cleartext. This enables a low-privileged user to create an administrator account and obtain SMTP credentials. The root cause, per the CVE details, is cleartext credential handling. Some sources note the issue was add...

PT-2020-12715

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 6.80 Build 2016031401 Description An issue was discovered that allows attackers to obtain the username and password of the SMTP user through the GetDistributedPOP3 function. Recommendations For CIPPlanner CIPAce versi...