CVE-2019-10960 | ByteOS Network

Vulnerability Details :

CVE-2019-10960

Assigner-icscert

Assigner Org ID-7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At-20 Aug, 2019 | 20:53

Updated At-04 Aug, 2024 | 22:40

Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:icscert

Assigner Org ID:7d14cffa-0d7d-4270-9dc0-52cabd5a23a6

Published At:20 Aug, 2019 | 20:53

Updated At:04 Aug, 2024 | 22:40

▼CVE Numbering Authority (CNA)

Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.

Affected Products

Vendor

Product

Zebra Industrial Printers All Versions

Versions

Affected

Zebra Industrial Printers All Versions

Problem Types

Type	CWE ID	Description
CWE	CWE-522	INSUFFICENTLY PROTECTED CREDENTIALS CWE-522

Type: CWE

CWE ID: CWE-522

Description: INSUFFICENTLY PROTECTED CREDENTIALS CWE-522

References

Hyperlink	Resource
https://www.us-cert.gov/ics/advisories/icsa-19-232-01	x_refsource_MISC

Hyperlink: https://www.us-cert.gov/ics/advisories/icsa-19-232-01

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.us-cert.gov/ics/advisories/icsa-19-232-01	x_refsource_MISC x_transferred

Hyperlink: https://www.us-cert.gov/ics/advisories/icsa-19-232-01

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:ics-cert@hq.dhs.gov

Published At:20 Aug, 2019 | 21:15

Updated At:02 Oct, 2020 | 14:11

Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

zebra>>zt610>>*

cpe:2.3:h:zebra:zt610:*:*:*:*:*:*:*:*

zebra>>zt610_firmware>>*

cpe:2.3:o:zebra:zt610_firmware:*:*:*:*:*:*:*:*

zebra>>zt620>>*

cpe:2.3:h:zebra:zt620:*:*:*:*:*:*:*:*

zebra>>zt620_firmware>>*

cpe:2.3:o:zebra:zt620_firmware:*:*:*:*:*:*:*:*

zebra>>zt510>>*

cpe:2.3:h:zebra:zt510:*:*:*:*:*:*:*:*

zebra>>zt510_firmware>>*

cpe:2.3:o:zebra:zt510_firmware:*:*:*:*:*:*:*:*

zebra>>zt410>>*

cpe:2.3:h:zebra:zt410:*:*:*:*:*:*:*:*

zebra>>zt410_firmware>>*

cpe:2.3:o:zebra:zt410_firmware:*:*:*:*:*:*:*:*

zebra>>zt420>>*

cpe:2.3:h:zebra:zt420:*:*:*:*:*:*:*:*

zebra>>zt420_firmware>>*

cpe:2.3:o:zebra:zt420_firmware:*:*:*:*:*:*:*:*

zebra>>zt220>>*

cpe:2.3:h:zebra:zt220:*:*:*:*:*:*:*:*

zebra>>zt220_firmware>>*

cpe:2.3:o:zebra:zt220_firmware:*:*:*:*:*:*:*:*

zebra>>zt230>>*

cpe:2.3:h:zebra:zt230:*:*:*:*:*:*:*:*

zebra>>zt230_firmware>>*

cpe:2.3:o:zebra:zt230_firmware:*:*:*:*:*:*:*:*

zebra>>220xi4>>*

cpe:2.3:h:zebra:220xi4:*:*:*:*:*:*:*:*

zebra>>220xi4_firmware>>*

cpe:2.3:o:zebra:220xi4_firmware:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-522	Primary	nvd@nist.gov
CWE-522	Secondary	ics-cert@hq.dhs.gov

CWE ID: CWE-522

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-522

Type: Secondary

Source: ics-cert@hq.dhs.gov

References

Hyperlink	Source	Resource
https://www.us-cert.gov/ics/advisories/icsa-19-232-01	ics-cert@hq.dhs.gov	Mitigation Third Party Advisory US Government Resource

Hyperlink: https://www.us-cert.gov/ics/advisories/icsa-19-232-01

Source: ics-cert@hq.dhs.gov

Resource:

Mitigation

Third Party Advisory

US Government Resource

Similar CVEs

296Records found

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.56% / 67.42%

||

7 Day CHG~0.00%

Published-23 Mar, 2020 | 21:45

Updated-04 Aug, 2024 | 11:14

Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp.

Vendor-zebra n/a

Product-fx9500 fx9500_firmware n/a

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-63.70% / 98.34%

||

7 Day CHG~0.00%

Published-31 Mar, 2018 | 21:00

Updated-05 Aug, 2024 | 07:17

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Vendor-sickrage n/a

Product-sickrage n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.10%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 20:51

Updated-16 Jan, 2025 | 21:37

CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected.

Vendor-CP PLUS (Aditya Group - Aditya Infotech Limited)

Product-kvms_pro KVMS Pro

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 46.34%

||

7 Day CHG~0.00%

Published-30 Oct, 2018 | 21:00

Updated-05 Aug, 2024 | 07:10

If an attacker has access to the firmware from the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be able to extract credentials.

Vendor-vecna n/a

Product-vgo_firmware vgo VGo Robot

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.78% / 72.66%

||

7 Day CHG~0.00%

Published-29 Mar, 2018 | 16:00

Updated-05 Aug, 2024 | 07:10

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.

Vendor-tnlsoftsolutions n/a

Product-sentry_vision n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Schneider Electric

Matching Score-4

Assigner-Schneider Electric

CVSS Score-9.8||CRITICAL

EPSS-0.28% / 51.18%

||

7 Day CHG~0.00%

Published-17 Sep, 2019 | 19:45

Updated-05 Aug, 2024 | 06:37

A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.

Product-ap9630 ap9631 ap9635 smart-ups_srt_5kva ap9635_firmware ap9630_firmware smart-ups_srt_5kva_firmware ap9631_firmware APC UPS Network Management Card 2 AOS

CWE ID-CWE-255

Not Available

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.54% / 66.64%

||

7 Day CHG~0.00%

Published-20 Jul, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 have cleartext credentials in /mib.db.

Vendor-televes n/a

Product-coaxdata_gateway_1gbps_firmware coaxdata_gateway_1gbps n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.11% / 30.77%

||

7 Day CHG~0.00%

Published-07 Apr, 2020 | 13:45

Updated-06 Aug, 2024 | 03:47

An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).

Vendor-n/a Google LLC

Product-android n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 46.34%

||

7 Day CHG~0.00%

Published-24 Jul, 2018 | 17:00

Updated-16 Sep, 2024 | 19:37

Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plaintext, which may allow an attacker with access to the configuration file to log into the SmartServer web user interface.

Vendor-echelon Echelon

Product-smartserver_2 i.lon_100_firmware smartserver_2_firmware smartserver_1_firmware i.lon_600_firmware i.lon_600 i.lon_100 smartserver_1 i.LON 100 i.LON 600 SmartServer 1 SmartServer 2

CWE ID-CWE-256

Plaintext Storage of a Password

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-6.9||MEDIUM

EPSS-0.06% / 18.64%

||

7 Day CHG+0.02%

Published-14 Jul, 2025 | 02:44

Updated-17 Jul, 2025 | 17:48

LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vendor-lb-link LB-LINK

Product-bl-ac3600_firmware bl-ac3600 BL-AC3600

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-284

Improper Access Control

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-9.8||CRITICAL

EPSS-0.25% / 47.94%

||

7 Day CHG~0.00%

Published-24 May, 2018 | 20:00

Updated-16 Sep, 2024 | 22:41

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.

Vendor-beaconmedaes ICS-CERT

Product-scroll_medical_air_systems scroll_medical_air_systems_firmware BeaconMedÃ¦s TotalAlert Scroll Medical Air Systems web application

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Mitsubishi Electric Corporation

Matching Score-4

Assigner-Mitsubishi Electric Corporation

CVSS Score-7.5||HIGH

EPSS-1.21% / 78.15%

||

7 Day CHG~0.00%

Published-03 Mar, 2023 | 04:18

Updated-05 Mar, 2025 | 20:02

Information Disclosure Vulnerability in MELSEC Series

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.

Vendor-Mitsubishi Electric Corporation

Product-fx5uj-24mt\/ess fx5s-40mt\/es_firmware fx5s-80mr\/es fx5uj-24mt\/es_firmware fx5uj-60mr\/es_firmware fx5uj-60mt\/ess fx5s-40mt\/es fx5-enet fx5uj-40mt\/es_firmware fx5-enet\/ip_firmware fx5uj-24mt\/ess_firmware fx5uc-32mt\/ds-ts fx5uj-24mr\/es-a fx5s-60mt\/es_firmware fx5uj-60mr\/es fx5uj-60mt\/ess_firmware fx5s-40mr\/es_firmware fx5uj-24mr\/es fx5s-30mr\/es_firmware fx5s-60mr\/es fx5uj-60mt\/es-a fx5uc-64mt\/d fx5uc-32mt\/dss fx5uj-40mr\/es_firmware fx5s-30mt\/es fx5s-60mr\/es_firmware fx5s-30mt\/ess_firmware fx5uj-24mt\/es-a_firmware fx5s-40mt\/ess_firmware fx5s-60mt\/es fx5uj-24mt\/es fx5uj-40mr\/es fx5s-30mt\/es_firmware fx5s-60mt\/ess fx5-enet_firmware fx5-enet\/ip fx5uc-64mt\/dss_firmware fx5uc-32mt\/dss_firmware fx5uc-96mt\/d_firmware fx5uj-60mr\/es-a_firmware fx5s-60mt\/ess_firmware fx5s-80mt\/es fx5uj-40mr\/es-a fx5s-40mr\/es fx5s-40mt\/ess fx5uj-60mt\/es fx5uc-32mt\/dss-ts fx5uj-24mr\/es-a_firmware fx5uc-32mt\/d fx5uj-60mt\/es_firmware fx5s-30mt\/ess fx5uj-60mr\/es-a fx5uj-40mt\/es-a fx5s-80mt\/ess fx5s-80mr\/es_firmware fx5uc-64mt\/dss fx5uc-96mt\/d fx5uc-32mr\/ds-ts_firmware fx5s-30mr\/es fx5uj-40mt\/ess_firmware fx5s-80mt\/es_firmware fx5uc-32mr\/ds-ts fx5uc-32mt\/ds-ts_firmware fx5uj-60mt\/es-a_firmware fx5uj-40mt\/es-a_firmware fx5uj-24mr\/es_firmware fx5uj-24mt\/es-a fx5uc-64mt\/d_firmware fx5uj-40mt\/ess fx5uj-40mt\/es fx5uc-32mt\/dss-ts_firmware fx5uc-96mt\/dss_firmware fx5uj-40mr\/es-a_firmware fx5s-80mt\/ess_firmware fx5uc-32mt\/d_firmware fx5uc-96mt\/dss MELSEC iQ-R Series R04ENCPU MELSEC iQ-F Series FX5UJ-60MR/ES-A MELSEC iQ-F Series FX5UJ-40MR/ES MELSEC-L Series L02CPU MELSEC iQ-F Series FX5S-60MT/ESS MELSEC iQ-F Series FX5S-80MT/ESS MELSEC iQ-R Series R16PCPU MELSEC-L Series L26CPU-PBT MELSEC iQ-F Series FX5U-64MT/DSS MELSEC-Q Series Q20UDEHCPU MELSEC iQ-F Series FX5UJ-24MR/ES-A MELSEC-Q Series Q06UDVCPU MELSEC-Q Series Q06UDPVCPU MELSEC iQ-R Series R16PSFCPU MELSEC iQ-F Series FX5U-64MT/ES MELSEC iQ-R Series R16SFCPU MELSEC iQ-F Series FX5U-64MT/ESS MELSEC-L Series L26CPU-P MELSEC iQ-R Series R32PCPU MELSEC iQ-F Series FX5UC-32MT/D MELSEC iQ-F Series FX5U-32MT/ESS MELSEC iQ-R Series R16CPU MELSEC iQ-R Series R32SFCPU MELSEC iQ-R Series R120PCPU MELSEC iQ-F Series FX5U-32MT/DSS MELSEC-L Series L06CPU MELSEC iQ-F Series FX5S-30MR/ES MELSEC iQ-F Series FX5U-32MT/ES MELSEC iQ-F Series FX5S-60MT/ES MELSEC iQ-F Series FX5UJ-60MT/ES MELSEC iQ-F Series FX5U-80MR/ES MELSEC iQ-F Series FX5-ENET MELSEC iQ-F Series FX5UC-32MT/DS-TS MELSEC iQ-F Series FX5S-40MT/ES MELSEC iQ-R Series R00CPU MELSEC-L Series LJ71E71-100 MELSEC iQ-F Series FX5U-64MR/DS MELSEC iQ-R Series R32CPU MELSEC iQ-F Series FX5-ENET/IP MELSEC iQ-R Series R120ENCPU MELSEC iQ-R Series R08PSFCPU MELSEC-L Series L26CPU MELSEC iQ-F Series FX5S-30MT/ESS MELSEC-Q Series Q03UDECPU MELSEC iQ-F Series FX5UC-32MR/DS-TS MELSEC iQ-F Series FX5UJ-24MT/ESS MELSEC-Q Series Q04UDEHCPU MELSEC-Q Series Q06UDEHCPU MELSEC iQ-F Series FX5U-32MR/DS MELSEC iQ-F Series FX5UJ-24MT/ES MELSEC-Q Series Q04UDPVCPU MELSEC-Q Series QJ71E71-100 MELSEC iQ-F Series FX5UJ-60MT/ES-A MELSEC iQ-F Series FX5S-60MR/ES MELSEC iQ-F Series FX5UC-96MT/D MELSEC iQ-F Series FX5UC-32MT/DSS-TS MELSEC iQ-F Series FX5S-40MT/ESS MELSEC iQ-F Series FX5UC-96MT/DSS MELSEC-Q Series Q26UDPVCPU MELSEC iQ-F Series FX5UC-32MT/DSS MELSEC iQ-F Series FX5U-64MT/DS MELSEC iQ-F Series FX5UC-64MT/D MELSEC-L Series L26CPU-BT MELSEC iQ-R Series R12CCPU-V MELSEC iQ-F Series FX5S-40MR/ES MELSEC iQ-R Series R120CPU MELSEC iQ-F Series FX5UJ-60MT/ESS MELSEC iQ-F Series FX5U-80MT/DS MELSEC iQ-F Series FX5U-32MT/DS MELSEC iQ-F Series FX5UJ-40MR/ES-A MELSEC iQ-F Series FX5S-30MT/ES MELSEC iQ-F Series FX5U-80MR/DS MELSEC-Q Series Q50UDEHCPU MELSEC-Q Series Q100UDEHCPU MELSEC-Q Series Q13UDPVCPU MELSEC iQ-F Series FX5S-80MR/ES MELSEC iQ-F Series FX5U-80MT/ES MELSEC iQ-F Series FX5U-80MT/ESS MELSEC iQ-F Series FX5UJ-24MR/ES MELSEC-L Series L06CPU-P MELSEC iQ-F Series FX5S-80MT/ES MELSEC iQ-R Series R08PCPU MELSEC iQ-R Series R08CPU MELSEC iQ-R Series R08SFCPU MELSEC iQ-F Series FX5UJ-40MT/ES MELSEC iQ-F Series FX5UJ-24MT/ES-A MELSEC iQ-R Series R32PSFCPU MELSEC iQ-R Series R120PSFCPU MELSEC iQ-R Series R01CPU MELSEC iQ-F Series FX5UJ-40MT/ESS MELSEC iQ-F Series FX5U-80MT/DSS MELSEC iQ-F Series FX5UJ-60MR/ES MELSEC-Q Series Q26UDVCPU MELSEC-Q Series Q26UDEHCPU MELSEC iQ-R Series R04CPU MELSEC-Q Series Q13UDVCPU MELSEC iQ-R Series RJ71EN71 MELSEC iQ-F Series FX5U-32MR/ES MELSEC iQ-F Series FX5UJ-40MT/ES-A MELSEC iQ-F Series FX5U-64MR/ES MELSEC iQ-R Series R02CPU MELSEC-L Series L02CPU-P MELSEC-Q Series Q03UDVCPU MELSEC iQ-R Series R08ENCPU MELSEC iQ-R Series R120SFCPU MELSEC iQ-R Series R16ENCPU MELSEC iQ-F Series FX5UC-64MT/DSS MELSEC-Q Series Q13UDEHCPU MELSEC-Q Series Q10UDEHCPU MELSEC iQ-R Series R32ENCPU MELSEC-Q Series Q04UDVCPU

CWE ID-CWE-256

Plaintext Storage of a Password

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-JetBrains s.r.o.

Matching Score-4

Assigner-JetBrains s.r.o.

CVSS Score-6.1||MEDIUM

EPSS-0.00% / 0.10%

||

7 Day CHG~0.00%

Published-29 Mar, 2023 | 12:07

Updated-12 Feb, 2025 | 16:22

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

Vendor-JetBrains s.r.o.

Product-intellij_idea IntelliJ IDEA

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-4.59% / 88.81%

||

7 Day CHG+0.50%

Published-29 Jan, 2025 | 00:00

Updated-31 Jan, 2025 | 21:15

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.

Vendor-n/a

Product-n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.2||MEDIUM

EPSS-0.07% / 22.52%

||

7 Day CHG~0.00%

Published-10 May, 2024 | 17:51

Updated-14 Jan, 2025 | 21:19

IBM TXSeries for Multiplatforms information disclosure

IBM TXSeries for Multiplatforms 8.2 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. IBM X-Force ID: 280192.

Vendor-IBM Corporation

Product-txseries_for_multiplatform TXSeries for Multiplatforms txseries_for_multiplatforms

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Apache Software Foundation

Matching Score-4

Assigner-Apache Software Foundation

CVSS Score-7.5||HIGH

EPSS-0.68% / 70.66%

||

7 Day CHG~0.00%

Published-13 Oct, 2020 | 18:23

Updated-05 Aug, 2024 | 11:58

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.

Vendor-n/a The Apache Software Foundation

Product-fineract Apache Fineract

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-17 Sep, 2024 | 02:07

Comtrend CM-6200un 123.447.007 and CM-6300n 123.553mp1.005 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-comtrend n/a

Product-cm-6300n cm-6300n_firmware cm-6200un cm-6200un_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-16 Sep, 2024 | 23:15

Technicolor TC7200.d1I TC7200.d1IE-N23E-c7000r5712-170406-HAT devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Vendor-technicolor n/a

Product-tc7200.d1i tc7200.d1i_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 16:52

CastleNet CBV38Z4EC 125.553mp1.39219mp1.899.007, CBV38Z4ECNIT 125.553mp1.39219mp1.899.005ITT, CBW383G4J 37.556mp5.008, and CBW38G4J 37.553mp1.008 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-castlenet n/a

Product-cbv38z4ec cbw383g4j_firmware cbw38g4j_firmware cbv38z4ecnit cbv38z4ecnit_firmware cbw383g4j cbw38g4j cbv38z4ec_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.82% / 73.45%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 17:23

ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-commscope n/a

Product-arris_sbg6580-2_firmware arris_sbg6580-2 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-16 Sep, 2024 | 20:41

Technicolor TC7110.B STC8.62.02 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32 SNMP requests.

Vendor-technicolor n/a

Product-tc7110.b_firmware tc7110.b n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-17 Sep, 2024 | 00:55

Kaonmedia CG2001-AN22A 1.2.1, CG2001-UDBNA 3.0.8, and CG2001-UN2NA 3.0.8 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-kaonmedia n/a

Product-cg2001-an22a cg2001-udbna cg2001-udbna_firmware cg2001-an22a_firmware cg2001-un2na cg2001-un2na_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-16 Sep, 2024 | 23:51

Technicolor TC7110.AR STD3.38.03 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32 SNMP requests.

Vendor-technicolor n/a

Product-tc7110.ar tc7110.ar_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 17:17

NETWAVE MNG6200 C4835805jrc12FU121413.cpr devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-net-wave n/a

Product-ming6200 ming6200_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.62% / 68.98%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-17 Sep, 2024 | 02:06

S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-n/a Cisco Systems, Inc.

Product-dpc2100_firmware dpc2100 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-17 Sep, 2024 | 00:16

Thomson DWG849 STC0.01.16, DWG850-4 ST9C.05.25, DWG855 ST80.20.26, and TWG870 STB2.01.36 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-technicolor n/a

Product-twg870 twg870_firmware dwg855_firmware dwg850-4_firmware dwg855 dwg850-4 dwg849 dwg849_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.82% / 73.45%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 18:13

ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-arris commscope n/a

Product-arris_dg950s arris_dg950a_firmware dg950s_firmware arris_dg950a n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-17 Sep, 2024 | 04:29

Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32 SNMP requests.

Vendor-technicolor n/a

Product-tc7200.th2v2 tc7200.th2v2_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.37% / 58.13%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-17 Sep, 2024 | 02:46

Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-170214a devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Vendor-technicolor n/a

Product-dpc3928sl dpc3928sl_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.01% / 0.72%

||

7 Day CHG~0.00%

Published-04 Jun, 2020 | 16:33

Updated-05 Aug, 2024 | 12:26

An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.

Vendor-n/a Foxit Software Incorporated

Product-phantompdf n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-25 Dec, 2018 | 15:00

Updated-17 Sep, 2024 | 00:36

Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.

Vendor-technicolor n/a

Product-cwa0101 cwa0101_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 17:28

TEKNOTEL CBW700N 81.447.392110.729.024 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-teknotel n/a

Product-cbw700n_firmware cbw700n n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 23:26

Skyworth CM5100 V1.1.0, CM5100-440 V1.2.1, CM5100-511 4.1.0.14, CM5100-GHD00 V1.2.2, and CM5100.g2 4.1.0.17 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-skyworthdigital n/a

Product-cm5100 cm5100_firmware cm5100.g2_firmware cm5100-440_firmware cm5100-511 cm5100-ghd00_firmware cm5100.g2 cm5100-511_firmware cm5100-ghd00 cm5100-440 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.07% / 88.08%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-05 Aug, 2024 | 11:58

Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-n/a Motorola Mobility LLC. (Lenovo Group Limited)

Product-sbg941_firmware sbg901_firmware sbg901 svg1202 svg1202_firmware sbg941 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-0.28% / 50.69%

||

7 Day CHG+0.10%

Published-22 Aug, 2022 | 14:45

Updated-03 Aug, 2024 | 16:53

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.

Vendor-n/a Red Hat, Inc.

Product-keycloak keycloak

CWE ID-CWE-522

Insufficiently Protected Credentials

CWE ID-CWE-209

Generation of Error Message Containing Sensitive Information

Matching Score-4

Assigner-Fidelis Cybersecurity, Inc.

Matching Score-4

Assigner-Fidelis Cybersecurity, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 53.36%

||

7 Day CHG~0.00%

Published-25 Jun, 2021 | 11:44

Updated-16 Sep, 2024 | 16:12

User Credentials Stored in a Recoverable Format within Fidelis Network and Deception

User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.

Vendor-fidelissecurity Fidelis Cybersecurity

Product-deception network Fidelis Deception Fidelis Network

CWE ID-CWE-257

Storing Passwords in a Recoverable Format

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 16:28

mplus CBC383Z CBC383Z_mplus_MDr026 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-mplustec n/a

Product-cbc383z cbc383z_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 16:17

Zoom 5352 v5.5.8.6Y devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-zoomtel n/a

Product-5352 5352_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.64% / 69.72%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 22:14

Bnmux BCW700J 5.20.7, BCW710J 5.30.6a, and BCW710J2 5.30.16 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-bnmux n/a

Product-bcw710j_firmware bcw700j_firmware bcw710j2_firmware bcw710j2 bcw710j bcw700j n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Johnson Controls

Matching Score-4

Assigner-Johnson Controls

CVSS Score-7.8||HIGH

EPSS-0.17% / 38.81%

||

7 Day CHG~0.00%

Published-13 Jan, 2023 | 00:00

Updated-07 Apr, 2025 | 19:45

Insufficiently Protected Credentials in Metasys

Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.

Vendor-johnsoncontrols Johnson Controls

Product-metasys_open_application_server metasys_application_and_data_server metasys_extended_application_and_data_server Metasys ADS/ADX/OAS

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.25% / 48.25%

||

7 Day CHG~0.00%

Published-19 Jun, 2020 | 16:47

Updated-05 Aug, 2024 | 12:26

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.

Vendor-n/a Mattermost, Inc.

Product-mattermost_server n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.58% / 67.85%

||

7 Day CHG~0.00%

Published-07 Nov, 2018 | 18:00

Updated-05 Aug, 2024 | 11:30

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStreamUri request contains the administrator username and password.

Vendor-foscam opticam n/a

Product-i5_system_firmware i5_application_firmware c2 i5 c2_system_firmware c2_application_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-7.5||HIGH

EPSS-82.44% / 99.18%

||

7 Day CHG~0.00%

Published-01 Jan, 2024 | 14:18

Updated-18 Jun, 2025 | 15:15

Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak

The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.

Vendor-Unknown W3 Eden, Inc.WordPress Download Manager Pro

Product-download_manager Download Manager

CWE ID-CWE-522

Insufficiently Protected Credentials

CWE ID-CWE-863

Incorrect Authorization

Matching Score-4

Assigner-OTRS AG

Matching Score-4

Assigner-OTRS AG

CVSS Score-8.1||HIGH

EPSS-0.18% / 39.54%

||

7 Day CHG~0.00%

Published-27 Nov, 2023 | 09:44

Updated-15 Oct, 2024 | 17:45

Password is send back to client

A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.

Vendor-OTRS AG

Product-otrs OTRS

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Sophos Limited

Matching Score-4

Assigner-Sophos Limited

CVSS Score-7.1||HIGH

EPSS-0.07% / 21.11%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 23:29

Updated-13 Sep, 2024 | 16:21

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.

Vendor-Sophos Ltd.

Product-firewall Sophos Firewall

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

Matching Score-4

Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)

CVSS Score-9.8||CRITICAL

EPSS-0.26% / 49.35%

||

7 Day CHG~0.00%

Published-12 Oct, 2018 | 14:00

Updated-16 Sep, 2024 | 19:37

Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allow an attacker to obtain credentials for remote access to controllers.

Vendor-yokogawa Yokogawa

Product-fcj fcn-500_firmware fcn-100_firmware fcn-500 fcn-rtu fcn-rtu_firmware fcj_firmware fcn-100 STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.38% / 79.48%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 17:33

D-Link DCM-604 DCM604_C1_ViaCabo_1.04_20130606 and DCM-704 EU_DCM-704_1.10 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-n/a D-Link Corporation

Product-dcm-604_firmware dcm-604 dcm-704_firmware dcm-704 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.30% / 53.23%

||

7 Day CHG~0.00%

Published-24 Dec, 2018 | 17:00

Updated-05 Aug, 2024 | 11:16

An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords in logcat during the process of setting up the phone as a hotspot.

Vendor-n/a Xiaomi

Product-xiaomi_mi-a1 xiaomi_mi-a1_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.47% / 63.81%

||

7 Day CHG~0.00%

Published-03 Oct, 2018 | 19:00

Updated-17 Sep, 2024 | 01:31

Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.10.1.5.0 and iso.3.6.1.4.1.236.11.5.11.81.10.1.6.0 SNMP requests.

Vendor-n/a Samsung

Product-scx-6545x scx-6545x_firmware n/a

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.82% / 73.45%

||

7 Day CHG~0.00%

Published-23 Dec, 2018 | 21:00

Updated-16 Sep, 2024 | 23:22

NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.

Vendor-telaum n/a

Product-ming2120j ming6300_firmware ming2120j_firmware ming6300 n/a

CWE ID-CWE-522

Insufficiently Protected Credentials