Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2012-3025

Summary
Assigner-icscert
Assigner Org ID-7d14cffa-0d7d-4270-9dc0-52cabd5a23a6
Published At-16 Aug, 2012 | 10:00
Updated At-16 Sep, 2024 | 17:53
Rejected At-
Credits

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:icscert
Assigner Org ID:7d14cffa-0d7d-4270-9dc0-52cabd5a23a6
Published At:16 Aug, 2012 | 10:00
Updated At:16 Sep, 2024 | 17:53
Rejected At:
▼CVE Numbering Authority (CNA)

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.tridium.com/cs/tridium_news/security_patch_36
x_refsource_CONFIRM
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
x_refsource_MISC
Hyperlink: http://www.tridium.com/cs/tridium_news/security_patch_36
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.tridium.com/cs/tridium_news/security_patch_36
x_refsource_CONFIRM
x_transferred
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
x_refsource_MISC
x_transferred
Hyperlink: http://www.tridium.com/cs/tridium_news/security_patch_36
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:ics-cert@hq.dhs.gov
Published At:16 Aug, 2012 | 10:38
Updated At:11 Apr, 2025 | 00:51

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.05.0MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
Primary2.05.0MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
Type: Primary
Version: 2.0
Base score: 5.0
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
Type: Primary
Version: 2.0
Base score: 5.0
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE Matches
tridium
tridium
>>niagara_ax>>Versions up to 3.6(inclusive)
cpe:2.3:a:tridium:niagara_ax:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-522Primarynvd@nist.gov
CWE ID: CWE-522
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://www.tridium.com/cs/tridium_news/security_patch_36ics-cert@hq.dhs.gov
Broken Link
Patch
Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdfics-cert@hq.dhs.gov
Broken Link
Third Party Advisory
US Government Resource
http://www.tridium.com/cs/tridium_news/security_patch_36af854a3a-2127-422b-91ae-364da2661108
Broken Link
Patch
Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdfaf854a3a-2127-422b-91ae-364da2661108
Broken Link
Third Party Advisory
US Government Resource
Hyperlink: http://www.tridium.com/cs/tridium_news/security_patch_36
Source: ics-cert@hq.dhs.gov
Resource:
Broken Link
Patch
Vendor Advisory
Hyperlink: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
Source: ics-cert@hq.dhs.gov
Resource:
Broken Link
Third Party Advisory
US Government Resource
Hyperlink: http://www.tridium.com/cs/tridium_news/security_patch_36
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Broken Link
Patch
Vendor Advisory
Hyperlink: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Broken Link
Third Party Advisory
US Government Resource

Change History

0
Information is not available yet

Similar CVEs

225Records found
CVE-2012-4027
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-5||MEDIUM
EPSS-0.17% / 38.69%
||
7 Day CHG~0.00%
Published-16 Jul, 2012 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.

Action-Not Available
Vendor-tridiumn/a
Product-niagara_axn/a
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2012-4028
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.12% / 31.00%
||
7 Day CHG~0.00%
Published-16 Jul, 2012 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication.

Action-Not Available
Vendor-tridiumn/a
Product-niagara_axn/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-7510
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-9.8||CRITICAL
EPSS-0.25% / 47.69%
||
7 Day CHG~0.00%
Published-06 Jun, 2018 | 20:00
Updated-16 Sep, 2024 | 22:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are presented in plaintext in a file that is accessible without authentication.

Action-Not Available
Vendor-beaconmedaesICS-CERT
Product-scroll_medical_air_systemsscroll_medical_air_systems_firmwareBeaconMedaes TotalAlert Scroll Medical Air Systems web application
CWE ID-CWE-256
Plaintext Storage of a Password
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2014-9702
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.34% / 56.18%
||
7 Day CHG~0.00%
Published-01 Jun, 2020 | 16:56
Updated-06 Aug, 2024 | 13:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.

Action-Not Available
Vendor-2pisoftwaren/a
Product-cmfiven/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2014-6039
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-83.63% / 99.26%
||
7 Day CHG~0.00%
Published-13 Jan, 2020 | 12:47
Updated-06 Aug, 2024 | 12:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.

Action-Not Available
Vendor-n/aZoho Corporation Pvt. Ltd.
Product-manageengine_eventlog_analyzern/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2014-5381
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-46.44% / 97.57%
||
7 Day CHG~0.00%
Published-13 Jan, 2020 | 13:00
Updated-06 Aug, 2024 | 11:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Grand MA 300 allows a brute-force attack on the PIN.

Action-Not Available
Vendor-grandingn/a
Product-grand_ma300grand_ma300_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-31044
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-7.5||HIGH
EPSS-0.16% / 36.80%
||
7 Day CHG~0.00%
Published-15 Jun, 2022 | 19:00
Updated-23 Apr, 2025 | 18:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. This affects those using any `Storage Converter` plugin. Rundeck 4.3.1 and 4.2.2 have fixed the code and upon upgrade will re-encrypt any plain text values. Version 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. To prevent plaintext credentials from being stored in Rundeck 4.2.0/4.2.1, write access to key storage can be disabled via ACLs. After upgrading to 4.3.1 or later, write access can be restored.

Action-Not Available
Vendor-pagerdutyrundeck
Product-rundeckrundeck
CWE ID-CWE-256
Plaintext Storage of a Password
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-29588
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.51% / 65.67%
||
7 Day CHG~0.00%
Published-16 May, 2022 | 05:30
Updated-03 Aug, 2024 | 06:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files.

Action-Not Available
Vendor-konicaminoltan/a
Product-bizhub_pro958_firmwarebizhub_c759_firmwarebizhub_c3351_firmwarebizhub_c3851bizhub_958bizhub_308bizhub_558e_firmwarebizhub_c759bizhub_c659bizhub_c450i_firmwarebizhub_c287bizhub_c658_firmwarebizhub_c658bizhub_c308_firmwarebizhub_c227_firmwarebizhub_c659_firmwarebizhub_808_firmwarebizhub_c450ibizhub_c3320i_firmwarebizhub_458bizhub_287bizhub_368bizhub_c300i_firmwarebizhub_c558bizhub_368_firmwarebizhub_558_firmwarebizhub_308_firmwarebizhub_4752bizhub_367bizhub_c458bizhub_458e_firmwarebizhub_c3350i_firmwarebizhub_c558_firmwarebizhub_758bizhub_c4050i_firmwarebizhub_4752_firmwarebizhub_c550ibizhub_c3851fs_firmwarebizhub_246i_firmwarebizhub_c300ibizhub_c650ibizhub_c3851fsbizhub_958_firmwarebizhub_227_firmwarebizhub_368ebizhub_c258bizhub_558bizhub_c250i_firmwarebizhub_306ibizhub_c650i_firmwarebizhub_306i_firmwarebizhub_c550i_firmwarebizhub_c3851_firmwarebizhub_658ebizhub_c458_firmwarebizhub_4052_firmwarebizhub_c368_firmwarebizhub_c3300ibizhub_808bizhub_c4000i_firmwarebizhub_c360i_firmwarebizhub_c4050ibizhub_368e_firmwarebizhub_287_firmwarebizhub_558ebizhub_c3350ibizhub_4052bizhub_226ibizhub_c250ibizhub_226i_firmwarebizhub_c4000ibizhub_458ebizhub_458_firmwarebizhub_758_firmwarebizhub_c3320ibizhub_367_firmwarebizhub_c287_firmwarebizhub_c368bizhub_c258_firmwarebizhub_c308bizhub_c360ibizhub_227bizhub_c227bizhub_246ibizhub_658e_firmwarebizhub_c3300i_firmwarebizhub_308ebizhub_c3351bizhub_308e_firmwarebizhub_pro958n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-9324
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.46% / 63.59%
||
7 Day CHG~0.00%
Published-18 Mar, 2020 | 13:13
Updated-04 Aug, 2024 | 10:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.

Action-Not Available
Vendor-aquaforestn/a
Product-tiff_servern/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-26948
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.8||MEDIUM
EPSS-0.26% / 48.68%
||
7 Day CHG~0.00%
Published-29 Mar, 2022 | 23:33
Updated-03 Aug, 2024 | 05:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks.

Action-Not Available
Vendor-n/aRSA Security LLC
Product-archern/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-23117
Matching Score-4
Assigner-Jenkins Project
ShareView Details
Matching Score-4
Assigner-Jenkins Project
CVSS Score-7.5||HIGH
EPSS-0.05% / 16.26%
||
7 Day CHG~0.00%
Published-12 Jan, 2022 | 19:06
Updated-03 Aug, 2024 | 03:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.

Action-Not Available
Vendor-Jenkins
Product-conjur_secretsJenkins Conjur Secrets Plugin
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2014-2581
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.99% / 83.28%
||
7 Day CHG~0.00%
Published-28 Jan, 2020 | 14:15
Updated-06 Aug, 2024 | 10:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.

Action-Not Available
Vendor-smb4k_projectn/aFedora Project
Product-smb4kfedoran/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-8210
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.31% / 53.57%
||
7 Day CHG~0.00%
Published-17 Aug, 2020 | 15:39
Updated-04 Aug, 2024 | 09:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account.

Action-Not Available
Vendor-n/aCitrix (Cloud Software Group, Inc.)
Product-xenmobile_serverCitrix XenMobile Server
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-8183
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-7.5||HIGH
EPSS-0.40% / 60.08%
||
7 Day CHG~0.00%
Published-30 Oct, 2020 | 18:13
Updated-04 Aug, 2024 | 09:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

Action-Not Available
Vendor-n/aNextcloud GmbH
Product-nextcloud_serverNextcloud Server
CWE ID-CWE-256
Plaintext Storage of a Password
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-24610
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.6||HIGH
EPSS-0.28% / 50.62%
||
7 Day CHG~0.00%
Published-24 Feb, 2022 | 11:04
Updated-03 Aug, 2024 | 04:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.

Action-Not Available
Vendor-alecton/a
Product-dvc-215ip_firmwaredvc-215ipn/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-23223
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-7.5||HIGH
EPSS-4.55% / 88.93%
||
7 Day CHG~0.00%
Published-25 Jan, 2022 | 13:00
Updated-03 Aug, 2024 | 03:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache ShenYu Password leakage

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

Action-Not Available
Vendor-The Apache Software Foundation
Product-shenyuApache ShenYu (incubating)
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-22998
Matching Score-4
Assigner-Western Digital
ShareView Details
Matching Score-4
Assigner-Western Digital
CVSS Score-8||HIGH
EPSS-0.28% / 50.62%
||
7 Day CHG~0.00%
Published-12 Jul, 2022 | 20:19
Updated-03 Aug, 2024 | 03:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Protecting AWS credentials stored in plaintext on My Cloud Home

Implemented protections on AWS credentials that were not properly protected.

Action-Not Available
Vendor-Western Digital Corp.Linux Kernel Organization, Inc
Product-linux_kernelmy_cloud_home_firmwaremy_cloud_homemy_cloud_home_duo_firmwaremy_cloud_home_duoMy Cloud Home
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-5260
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-9.3||CRITICAL
EPSS-38.09% / 97.11%
||
7 Day CHG+1.28%
Published-14 Apr, 2020 | 22:50
Updated-04 Aug, 2024 | 08:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
malicious URLs may cause Git to present stored credentials to the wrong server

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

Action-Not Available
Vendor-gitgit-scmgitCanonical Ltd.openSUSEFedora ProjectDebian GNU/Linux
Product-ubuntu_linuxdebian_linuxfedoragitleapgit
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2013-2106
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.5||HIGH
EPSS-0.40% / 60.01%
||
7 Day CHG~0.00%
Published-03 Dec, 2019 | 13:21
Updated-06 Aug, 2024 | 15:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

webauth before 4.6.1 has authentication credential disclosure

Action-Not Available
Vendor-stanfordwebauthDebian GNU/Linux
Product-webauthdebian_linuxwebauth
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2013-2672
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.69% / 71.21%
||
7 Day CHG~0.00%
Published-03 Feb, 2020 | 16:39
Updated-06 Aug, 2024 | 15:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.

Action-Not Available
Vendor-n/aBrother Industries, Ltd.
Product-mfc-9970cdwmfc-9970cdw_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-22396
Matching Score-4
Assigner-IBM Corporation
ShareView Details
Matching Score-4
Assigner-IBM Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.09% / 24.93%
||
7 Day CHG~0.00%
Published-06 Jun, 2022 | 16:30
Updated-16 Sep, 2024 | 16:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231.

Action-Not Available
Vendor-IBM CorporationLinux Kernel Organization, Inc
Product-linux_kernelspectrum_protect_plusSpectrum Protect Plus
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-29321
Matching Score-4
Assigner-Cyber Security Works Pvt. Ltd.
ShareView Details
Matching Score-4
Assigner-Cyber Security Works Pvt. Ltd.
CVSS Score-7.5||HIGH
EPSS-0.83% / 74.14%
||
7 Day CHG~0.00%
Published-04 Jun, 2021 | 19:40
Updated-04 Aug, 2024 | 16:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data.

Action-Not Available
Vendor-n/aD-Link Corporation
Product-dir-868ldir-868l_firmwareD-Link Router DIR-868L
CWE ID-CWE-798
Use of Hard-coded Credentials
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-29005
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.09% / 25.52%
||
7 Day CHG~0.00%
Published-29 Jan, 2021 | 06:19
Updated-04 Aug, 2024 | 16:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure.

Action-Not Available
Vendor-n/aWikimedia Foundation
Product-mediawikin/a
CWE ID-CWE-319
Cleartext Transmission of Sensitive Information
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-29054
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.40% / 60.47%
||
7 Day CHG~0.00%
Published-24 Nov, 2020 | 21:01
Updated-04 Aug, 2024 | 16:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. Attackers can use "show system infor" to discover cleartext TELNET credentials.

Action-Not Available
Vendor-n/aC-DATA Technologies Co., Ltd.
Product-fd1216s-r197168p_firmwarefd1208s-r2fd1204s-r2_firmwarefd1616gsfd1002s9016afd1104fd1204sn-r2fd1616sn_firmwarefd1104sfd1204sn_firmwarefd1608gs97168pfd1002s_firmware97084p92416a_firmware9016a_firmwarefd1616gs_firmware97028p9288_firmwarefd1608gs_firmwarefd1104sn_firmwarefd1608sn_firmwarefd1608sn9008a_firmwarefd1204sn-r2_firmwarefd1104b_firmware72408a97028p_firmwarefd1104bfd1204snfd8000_firmware92408afd1104s_firmware97042p_firmware92416afd1104snfd1204s-r297024p97016_firmware928897024p_firmware97084p_firmwarefd1104_firmwarefd1208s-r2_firmwarefd80009008afd1108s72408a_firmware97042pfd1216s-r1_firmware92408a_firmwarefd1108s_firmwarefd1616sn97016n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-27888
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.28% / 50.62%
||
7 Day CHG~0.00%
Published-27 Oct, 2020 | 19:25
Updated-04 Aug, 2024 | 16:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered on Ubiquiti UniFi Meshing Access Point UAP-AC-M 4.3.21.11325 and UniFi Controller 6.0.28 devices. Cached credentials are not erased from an access point returning wirelessly from a disconnected state. This may provide unintended network access.

Action-Not Available
Vendor-n/aUbiquiti Inc.
Product-unifi_meshing_access_pointunifi_controllerunifi_meshing_access_point_firmwareunifi_controller_firmwaren/a
CWE ID-CWE-459
Incomplete Cleanup
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-1413
Matching Score-4
Assigner-GitLab Inc.
ShareView Details
Matching Score-4
Assigner-GitLab Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.21% / 43.15%
||
7 Day CHG~0.00%
Published-19 May, 2022 | 17:11
Updated-03 Aug, 2024 | 00:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface

Action-Not Available
Vendor-GitLab Inc.
Product-gitlabGitLab
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2012-6663
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-23.14% / 95.79%
||
7 Day CHG~0.00%
Published-23 Jan, 2020 | 21:47
Updated-06 Aug, 2024 | 21:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

General Electric D20ME devices are not properly configured and reveal plaintext passwords.

Action-Not Available
Vendor-gen/a
Product-d20med20me_firmwared200d200_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-26515
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.07% / 21.85%
||
7 Day CHG~0.00%
Published-08 Jun, 2021 | 12:47
Updated-04 Aug, 2024 | 15:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key.

Action-Not Available
Vendor-intlandn/a
Product-codebeamern/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CWE ID-CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CVE-2020-26508
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.30% / 53.33%
||
7 Day CHG~0.00%
Published-16 Nov, 2020 | 18:49
Updated-04 Aug, 2024 | 15:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though these are intentionally inaccessible in the UI.

Action-Not Available
Vendor-n/aCanon Inc.
Product-oce_colorwave_3500_firmwareoce_colorwave_3500n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-25235
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-7.5||HIGH
EPSS-0.31% / 53.79%
||
7 Day CHG~0.00%
Published-14 Dec, 2020 | 21:05
Updated-04 Aug, 2024 | 15:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The password used for authentication for the LOGO! Website and the LOGO! Access Tool is sent in a recoverable format. An attacker with access to the network traffic could derive valid logins.

Action-Not Available
Vendor-Siemens AG
Product-logo\!_8_bmlogo\!_8_bm_firmwareLOGO! 8 BM (incl. SIPLUS variants)
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2020-25175
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-9.8||CRITICAL
EPSS-0.24% / 46.15%
||
7 Day CHG~0.00%
Published-14 Dec, 2020 | 16:36
Updated-04 Aug, 2024 | 15:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.

Action-Not Available
Vendor-gehealthcaren/a
Product-signa_vibrant_firmwareinnova_313-iq_firmwarelightspeed_rt16_firmwarediscovery_ct590rtlogiq_9_bt06definium_8000innova_4100-iqinnova_2100-iq_firmwareoptima_xr220amx_firmwarebrivo_definiuoptima_xr640_firmwarediscovery_ct590rt_firmwareoptima_ct6703.0t_signa_hd_23signa_hdi_1.5tlogiq_9_bt02_firmwareoptima_mr360_firmwarediscovery_iqimage_vault_firmwarebrivo_xr383optima_igs_320optima_ct68_firmwareoptima_3100_firmwarediscovery_nm\/ct_860_firmwarediscovery_ct750hd_firmwareinnova_2000_firmwareoptima_ct660_firmwareoptima_cl323i_firmwarelogiq_7_bt03_firmwareoptima_ct520brivo_xr515_firmwareinnova_igs_620_firmwareoptima_xr640optima_xr220amxoptima_advance_firmwarediscovery_xr656echopac_bt06_firmwareoptima_ct520_firmwarediscovery_nm_630_firmwareseno_essentialpetrace_800_firmwarelogiq_7_bt06optima_cl320_firmwarevivid_7_bt02_firmwarediscovery_ct750hdoptima_mr360revolution_actsinnova_4100brivo_xr575_firmwareprecision_500d_firmwarelogiq_9_bt03innova_igs_630lightspeed_vct_firmwareoptima_320_firmwarebrightspeed_elite_select_firmwarelogiq_9_bt06_firmwareoptima_cl320innova_igs_530optima_ct540_firmwaredefinium_5000innova_igs_520logiq_9_bt04_firmwarerevolution_acts_firmwareinnova_4100_firmwareoptima_ct68discovery_xr656_firmwareoptima_nm\/ct_640_firmware3.0t_signa_hd_16innova_igs_730_firmwareinnova_212-iqoptima_igs_330_firmwarewdr1_firmwarelogiq_9_bt03_firmwarebrightspeed_eliteinnova_3100-iqinnova_212-iq_firmwareechopac_bt06optima_ct660pet_discovery_iq_firmwarepet_discovery_iq_upgrade_firmwarevoluson_730_bt08innova_313-iqvoluson_730_bt05optima_igs_320_firmwarepet_discovery_iq_upgradelightspeed_vctoptima_xr646seno_200dbrightspeed_edge_select_firmwareinnova_3100_firmwarediscovery_mi_mi_dr_firmwareoptima_expert_\&_professional_firmwareimage_vaultrevolution_frontier_esdiscovery_nm_630seno_ds_firmwarediscovery_nm\/ct_670_firmware3.0t_signa_hd_16_firmwarebrightspeed_elite_firmwarewdr1innova_igs_630_firmwareprecision_500dbrivo_definiu_firmwarebrivo_ct385_firmwarelightspeed_pro16logiq_7_bt06_firmwaredefinium_8000_firmwareoptima_ct670_firmwareoptima_igs_330infiniabrightspeed_edge_firmwareoptima_quantumseno_essential_firmwarebrightspeed_edgeoptima_ct580woptima_nm\/ct_640revolution_frontierinnova_4100-iq_firmwarexeleris_firmwareoptima_ct580w_firmwareoptima_xr200amx_firmwarediscovery_xr650_firmwarelogiq_7_bt04optima_ct580_firmwarevoluson_730_bt08_firmwareseno_dsrevolution_hdvivid_7_bt06_firmwarelogiq_9_bt04logiq_7_bt03discovery_nm\/ct_670innova_igs_730optima_expert_\&_professionalbrivo_xr383_firmwareoptima_xr200amxdiscovery_nm_d530cbrivo_nm_615revolution_evo_firmwarediscovery_nm\/ct850_firmwareoptima_ct580rtdefinium_6000_firmwareoptima_advanceoptima_cl320i_firmwaresenographe_pristina_firmwarediscovery_nm830revolution_act_firmwareventriinnova_igs_6201.5t_brivo_mr355lightspeed_rt16innova_igs_520_firmwarediscovery_nm\/ct_d570c_firmwarevivid_7_bt02innova_3100-iq_firmwarelogiq_7_bt04_firmwareoptima_cl323irevolution_ct_firmwarelogiq_5_bt03logiq_5_bt03_firmwareinnova_3100innova_2000pet_discovery_iqrevolution_evodiscovery_nm830_firmwarevoluson_730_bt05_firmwaresigna_vibrantpetrace_8003.0t_signa_hdxt_firmwaredefinium_5000_firmwaresenographe_pristinabrivo_nm_615_firmwarediscovery_xr656\+_firmwarediscovery_xr656\+optima_cl320idefinium_6000brightspeed_elite_selectventri_firmwarerevolution_frontier_es_firmwarediscovery_nm\/ct_860revolution_actdiscovery_nm\/ct_870_firmwarerevolution_ctoptima_ct580rt_firmwareinnova_igs_530_firmwaresigna_hdi_1.5t_firmwarebrivo_xr118_firmwarevivid_7_bt06seno_200d_firmwarebrightspeed_edge_selectbrivo_ct3853.0t_signa_hdxtbrivo_xr575vivid_i_bt06_firmwarediscovery_xr650brivo_xr515revolution_discovery_ct_firmwarediscovery_nm\/ct_d570cxelerisinfinia_firmwarediscovery_nm_750b_firmwareoptima_3100amx_700_firmwarediscovery_nm\/ct_870optima_xr646_firmwarediscovery_mi_mi_drrevolution_hd_firmwarevivid_i_bt063.0t_signa_hd_23_firmwarediscovery_nm_750bdiscovery_nm_d530c_firmwarediscovery_nm\/ct850lightspeed_pro16_firmwarerevolution_discovery_ctbrivo_xr118revolution_frontier_firmwareoptima_ct540optima_ct580amx_700optima_320discovery_iq_firmwareoptima_quantum_firmwarelogiq_9_bt021.5t_brivo_mr355_firmwareinnova_2100-iqGE Healthcare Imaging and Ultrasound Products
CWE ID-CWE-523
Unprotected Transport of Credentials
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2022-1026
Matching Score-4
Assigner-Rapid7, Inc.
ShareView Details
Matching Score-4
Assigner-Rapid7, Inc.
CVSS Score-8.6||HIGH
EPSS-86.78% / 99.41%
||
7 Day CHG~0.00%
Published-04 Apr, 2022 | 14:15
Updated-16 Sep, 2024 | 20:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Kyocera Net View Address Book Exposure

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

Action-Not Available
Vendor-kyoceraKyocera
Product-net_viewerMultifunction Printer Net Viewer
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-21239
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.3||MEDIUM
EPSS-0.01% / 0.94%
||
7 Day CHG~0.00%
Published-04 Jun, 2020 | 16:31
Updated-05 Aug, 2024 | 12:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action.

Action-Not Available
Vendor-n/aFoxit Software Incorporated
Product-phantompdfreadern/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-21237
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.3||MEDIUM
EPSS-0.01% / 0.94%
||
7 Day CHG~0.00%
Published-04 Jun, 2020 | 16:33
Updated-05 Aug, 2024 | 12:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.

Action-Not Available
Vendor-n/aFoxit Software Incorporated
Product-phantompdfn/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20399
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-2.94% / 86.13%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-05 Aug, 2024 | 11:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-n/aMotorola Mobility LLC. (Lenovo Group Limited)
Product-sbg941_firmwaresbg901_firmwaresbg901svg1202svg1202_firmwaresbg941n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20386
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.82% / 73.97%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 17:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-commscopen/a
Product-arris_sbg6580-2_firmwarearris_sbg6580-2n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20396
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.82% / 73.97%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 23:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-telaumn/a
Product-ming2120jming6300_firmwareming2120j_firmwareming6300n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20389
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.38% / 79.96%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 17:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-n/aD-Link Corporation
Product-dcm-604_firmwaredcm-604dcm-704_firmwaredcm-704n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20391
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 70.19%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 17:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-teknoteln/a
Product-cbw700n_firmwarecbw700nn/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20394
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 70.19%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-17 Sep, 2024 | 00:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-twg870twg870_firmwaredwg855_firmwaredwg850-4_firmwaredwg855dwg850-4dwg849dwg849_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20445
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.55% / 67.34%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-16 Sep, 2024 | 23:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 and iso.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32 SNMP requests.

Action-Not Available
Vendor-n/aD-Link Corporation
Product-dcm-604_firmwaredcm-604dcm-704_firmwaredcm-704n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20382
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 70.19%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 21:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Jiuzhou BCM93383WRG 139.4410mp1.3921132mp1.899.004404.004 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-jezetek-intln/a
Product-bcm93383wrg_firmwarebcm93383wrgn/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20443
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.47% / 64.26%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-16 Sep, 2024 | 23:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-tc7200.d1itc7200.d1i_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20444
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.37% / 58.44%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-16 Sep, 2024 | 21:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-cga0111_firmwarecga0111n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20439
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.37% / 58.44%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-17 Sep, 2024 | 02:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-dpc3928sldpc3928sl_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20395
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 70.19%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 17:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-net-waven/a
Product-ming6200ming6200_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20440
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.47% / 64.26%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-17 Sep, 2024 | 00:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-cwa0101cwa0101_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20438
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.47% / 64.26%
||
7 Day CHG~0.00%
Published-25 Dec, 2018 | 15:00
Updated-16 Sep, 2024 | 23:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32 SNMP requests.

Action-Not Available
Vendor-technicolorn/a
Product-tc7110.artc7110.ar_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20401
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 70.19%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 16:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-zoomteln/a
Product-53525352_firmwaren/a
CWE ID-CWE-522
Insufficiently Protected Credentials
CVE-2018-20392
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.62% / 69.46%
||
7 Day CHG~0.00%
Published-23 Dec, 2018 | 21:00
Updated-17 Sep, 2024 | 02:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Action-Not Available
Vendor-n/aCisco Systems, Inc.
Product-dpc2100_firmwaredpc2100n/a
CWE ID-CWE-522
Insufficiently Protected Credentials
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • Next
Details not found