Filtered by CWE-255
Filtered by vendor Subscriptions
Total 759 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-6047 1 3m 1 Detcon Sitewatch Gateway 2024-11-21 N/A
Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication.
CVE-2017-18470 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
CVE-2017-17836 1 Apache 1 Airflow 2024-11-21 N/A
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.
CVE-2017-13717 1 Starry 2 S00111, S00111 Firmware 2024-11-21 N/A
Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are stored in clear text on the device and can be pulled easily.
CVE-2017-10718 1 Ishekar 2 Endoscope Camera, Endoscope Camera Firmware 2024-11-21 N/A
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the device can change the default SSID and password thereby denying the owner an access to his/her own device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.
CVE-2016-9593 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-11-21 N/A
foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.
CVE-2016-9489 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.
CVE-2016-8616 2 Haxx, Redhat 3 Curl, Jboss Core Services, Rhel Software Collections 2024-11-21 N/A
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
CVE-2016-8366 1 Phoenixcontact 2 Ilc Plcs, Ilc Plcs Firmware 2024-11-21 N/A
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text.
CVE-2016-7043 1 Redhat 1 Kie-server 2024-11-21 N/A
It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.
CVE-2016-6599 1 Bmc 1 Track-it\! 2024-11-21 N/A
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
CVE-2016-6554 1 Synology 6 Ds107, Ds107 Firmware, Ds116 and 3 more 2024-11-21 N/A
Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.
CVE-2016-6553 1 Nuuo 2 Nt-4040 Titan, Nt-4040 Titan Firmware 2024-11-21 N/A
Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111. A remote network attacker can gain privileged access to a vulnerable device.
CVE-2016-6552 1 Greenpacket 2 Dx-350, Dx-350 Firmware 2024-11-21 N/A
Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device.
CVE-2016-6551 1 Intelliantech 26 T100q, T100q Firmware, T100w and 23 more 2024-11-21 N/A
Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses non-random default credentials of: ftp/ftp or intellian:12345678. A remote network attacker can gain elevated access to a vulnerable device.
CVE-2016-6547 1 Nutspace 1 Nut Mobile 2024-11-21 N/A
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
CVE-2016-6546 1 Kkmcn 1 Itrackeasy 2024-11-21 N/A
The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext.
CVE-2016-6538 1 Thetrackr 2 Trackr Bravo, Trackr Bravo Firmware 2024-11-21 N/A
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
CVE-2016-3952 1 Web2py 1 Web2py 2024-11-21 N/A
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.
CVE-2016-10821 1 Cpanel 1 Cpanel 2024-11-21 N/A
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).