Filtered by CWE-522
Filtered by vendor Subscriptions
Total 1129 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-5505 1 Netapp 1 Ontap Select Deploy Administration Utility 2024-11-21 9.8 Critical
ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext.
CVE-2019-4724 2 Ibm, Netapp 2 Cognos Analytics, Oncommand Insight 2024-11-21 7.5 High
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page. IBM X-Force ID: 172130.
CVE-2019-4723 2 Ibm, Netapp 2 Cognos Analytics, Oncommand Insight 2024-11-21 7.5 High
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page. IBM X-Force ID: 172129.
CVE-2019-4697 1 Ibm 2 Guardium Data Encryption, Guardium For Cloud Key Management 2024-11-21 6.5 Medium
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938.
CVE-2019-4693 1 Ibm 2 Guardium Data Encryption, Guardium For Cloud Key Management 2024-11-21 4.4 Medium
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 171831.
CVE-2019-4668 1 Ibm 1 Urbancode Deploy 2024-11-21 5.5 Medium
IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250.
CVE-2019-4508 1 Ibm 1 Qradar Security Information And Event Manager 2024-11-21 7.8 High
IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429.
CVE-2019-4385 1 Ibm 1 Spectrum Protect Plus 2024-11-21 6.5 Medium
IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.
CVE-2019-4335 1 Ibm 1 Watson Studio Local 2024-11-21 5.5 Medium
IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413.
CVE-2019-4307 1 Ibm 1 Security Guardium Big Data Intelligence 2024-11-21 5.5 Medium
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987.
CVE-2019-4239 2 Ibm, Redhat 2 Cloud Private, Openshift 2024-11-21 5.5 Medium
IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465.
CVE-2019-4138 1 Ibm 1 Spectrum Control 2024-11-21 N/A
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334.
CVE-2019-4059 1 Ibm 1 Rational Clearcase 2024-11-21 9.8 Critical
IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. An attacker could obtain the password and gain unauthorized access to the document database. IBM X-Force ID: 156583.
CVE-2019-3947 1 Fujielectric 1 V-server 2024-11-21 N/A
Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.
CVE-2019-3942 1 Advantech 1 Webaccess 2024-11-21 7.5 High
Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.
CVE-2019-3938 1 Crestron 4 Am-100, Am-100 Firmware, Am-101 and 1 more 2024-11-21 7.8 High
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any configuration file since all the encryption logic is hard coded. A local attacker can use this vulnerability to gain access to devices username and passwords.
CVE-2019-3800 27 Anynines, Apigee, Appdynamics and 24 more 55 Elasticsearch, Logme, Mongodb and 52 more 2024-11-21 N/A
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
CVE-2019-3782 1 Cloudfoundry 1 Credhub Cli 2024-11-21 7.8 High
Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
CVE-2019-3780 1 Cloudfoundry 1 Container Runtime 2024-11-21 8.8 High
Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.
CVE-2019-3753 1 Dell 12 Emc Powerconnect 7000, Emc Powerconnect 7000 Firmware, Emc Powerconnect 8024 and 9 more 2024-11-21 6.5 Medium
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.