Filtered by CWE-261
Filtered by vendor Subscriptions
Total 27 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-5434 1 Campbellsci 2 Csi Web Server, Rtmc 2024-11-21 N/A
The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.
CVE-2024-45273 3 Helmholz, Mb Connect Line, Mbconnectline 35 Myrex24.virtual, Myrex24 V2, Myrex24 V2 Virtual Server and 32 more 2024-11-21 8.4 High
An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used.
CVE-2024-34113 1 Adobe 1 Coldfusion 2024-11-21 5.5 Medium
ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could exploit this weakness to decrypt or guess passwords, potentially gaining unauthorized access to protected resources. Exploitation of this issue does not require user interaction.
CVE-2024-28270 1 Enilu 1 Web-flash 2024-11-21 8.1 High
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
CVE-2024-24279 2024-11-21 8.8 High
An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions.
CVE-2024-23492 2024-11-21 5.7 Medium
A weak encoding is used to transmit credentials for WS203VICM.
CVE-2024-0556 1 Xantech 2 Wic1200, Wic1200 Firmware 2024-11-21 7.1 High
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text.
CVE-2023-7237 1 Lantronix 2 Xport Edge, Xport Edge Firmware 2024-11-21 5.7 Medium
Lantronix XPort sends weakly encoded credentials within web request headers.
CVE-2023-43776 1 Eaton 44 Easy-box-e4-ac1, Easy-box-e4-ac1 Firmware, Easy-box-e4-dc1 and 41 more 2024-11-21 6.8 Medium
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported to SD card (*.PRG file ending).
CVE-2023-28896 1 Preh 2 Mib3, Mib3 Firmware 2024-11-21 3.3 Low
Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
CVE-2023-22271 1 Adobe 2 Experience Manager, Experience Manager Cloud Service 2024-11-21 5.3 Medium
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complexity is high since a successful exploitation requires to already have in possession this encrypted secret.
CVE-2023-0525 1 Mitsubishielectric 14 Gs21, Gs21 Firmware, Gs25 and 11 more 2024-11-21 7.5 High
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.
CVE-2023-0356 1 Socomec 2 Modulys Gp, Net Vision 2024-11-21 5.7 Medium
SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threat actors obtaining sensitive information.
CVE-2022-45099 1 Dell 1 Emc Powerscale Onefs 2024-11-21 7.8 High
Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise
CVE-2022-38469 1 Ge 1 Proficy Historian 2024-11-21 7.5 High
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
CVE-2022-35931 1 Nextcloud 1 Password Policy 2024-11-21 2.7 Low
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.
CVE-2022-34445 1 Dell 1 Powerscale Onefs 2024-11-21 6 Medium
Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password. A malicious local privileged attacker may potentially exploit this vulnerability, leading to information disclosure.
CVE-2021-21507 1 Dell 22 R1-2210, R1-2210 Firmware, R1-2401 and 19 more 2024-11-21 8.8 High
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
CVE-2020-14481 1 Rockwellautomation 1 Factorytalk View 2024-11-21 7.8 High
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Windows user or Windows DeskLock passwords. If the compromised user has an administrative account, an attacker could gain full access to the user’s operating system and certain components of FactoryTalk View SE.
CVE-2020-10919 1 Automationdirect 13 C-more Hmi Ea9 Firmware, Ea9-pgmsw, Ea9-rhmi and 10 more 2024-11-21 5.9 Medium
This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185.