CVE & Exploit Intelligence Database

CVE-2024-34882 4.9 MEDIUM 1 Writeup EPSS 0.00

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request.

CWE-522 Nov 04, 2024

CVE-2023-50310 4.9 MEDIUM EPSS 0.00

IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CWE-522 Oct 23, 2024

CVE-2024-43812 8.4 HIGH EPSS 0.00

Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of all users on the system.

CWE-522 Oct 22, 2024

CVE-2024-9677 5.5 MEDIUM EPSS 0.00

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

CWE-522 Oct 22, 2024

CVE-2024-44000 9.8 CRITICAL EXPLOITED 6 PoCs Analysis NUCLEI EPSS 0.93

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a before 6.5.0.1.

CWE-522 Oct 20, 2024

CVE-2024-7755 8.2 HIGH EPSS 0.00

The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.

CWE-522 Oct 17, 2024

CVE-2024-49396 EPSS 0.00

The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.

CWE-522 Oct 17, 2024

CVE-2024-20462 5.5 MEDIUM EPSS 0.00

A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML content from an affected device. A successful exploit could allow the attacker to view passwords that belong to other users.

CWE-522 Oct 16, 2024

CVE-2024-47161 4.3 MEDIUM EPSS 0.00

In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

CWE-522 Oct 08, 2024

CVE-2024-47805 7.5 HIGH EPSS 0.00

Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the `SecretBytes` type when accessing item `config.xml` via REST API or CLI.

CWE-522 Oct 02, 2024

CVE-2024-37187 5.7 MEDIUM EPSS 0.00

Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.

CWE-522 Sep 27, 2024

CVE-2024-34542 5.7 MEDIUM EPSS 0.00

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.

CWE-522 Sep 27, 2024

CVE-2024-45744 3.0 LOW EPSS 0.00

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.

CWE-312 Sep 27, 2024

CVE-2024-31899 4.3 MEDIUM EPSS 0.00

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could disclose highly sensitive user information to an authenticated user with physical access to the device.

CWE-522 Sep 26, 2024

CVE-2024-9014 9.9 CRITICAL EXPLOITED 2 PoCs Analysis NUCLEI EPSS 0.93

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

CWE-522 Sep 23, 2024

CVE-2024-40703 5.5 MEDIUM EPSS 0.00

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications.

CWE-522 Sep 22, 2024

CVE-2024-47162 4.1 MEDIUM EPSS 0.00

In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page

CWE-522 Sep 19, 2024

CVE-2024-8986 EPSS 0.00

The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for instance, to allow for fetching of private dependencies), the final binary will contain the full URI, including said credentials.

CWE-522 Sep 19, 2024

CVE-2024-8777 7.5 HIGH EPSS 0.00

OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP authentication is enabled, attackers can obtain plaintext credentials.

CWE-522 Sep 16, 2024

CVE-2024-31415 6.3 MEDIUM EPSS 0.00

The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration.

CWE-522 Sep 13, 2024