3117 matches found
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2020-18406
CVE-2020-18406 affects cmseasy v7.0.0 (CMS). The root cause is that form data is not encrypted, allowing user credentials to be sent in clear text. Several sources corroborate the issue and describe the impact as credential exposure over potentially plaintext channels. Documented risk factors inc...
CVE-2020-18406
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...
CVE-2023-35928
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until...
IBM Security Directory Suite VA Information Disclosure Vulnerability (CNVD-2023-51456)
IBM Security Directory Suite is a scalable, standards-based identity platform from International Business Machines IBM that simplifies identity and directory management. An information disclosure vulnerability exists in IBM Security Directory Suite VA, which could be exploited by an attacker to...
Design/Logic Flaw
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 228567...
CVE-2022-33159 IBM Security Directory Suite VA information disclosure
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 228567...
CVE-2023-2729
Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager DSM before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors...
CVE-2023-2729
Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager DSM before 7.2-64561 allows remote attackers to obtain user credential via unspecified vectors...
Cisco Secure Workload Authenticated OpenAPI Privilege Escalation Vulnerability
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper...
Medium: curl
Issue Overview: The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the server negotiation. Due to lack of proper input scrubbing and without it being the...
PUB-A-222287335
In listkeyentries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation...
CVE-2023-32319 Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issu...
CVE-2023-32319 Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issu...
CVE-2023-32319 Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issu...
CVE-2022-4945 CVE-2022-4945
The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud...
SAP BusinessObjects Business Intelligence Platform Information Disclosure (3302595)
The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a information disclosure vulnerability. SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over...
PT-2023-15931 · Dataprobe · Dataprobe Cloud
Name of the Vulnerable Software and Affected Versions: Dataprobe cloud affected versions not specified Description: The Dataprobe cloud stores usernames and passwords in plain text in a specific file. Any user able to read this file from the device could compromise other devices connected to the...