CVE & Exploit Intelligence Database

CVE-2023-28087 5.5 MEDIUM EPSS 0.00

An HPE OneView appliance dump may expose OneView user accounts

CWE-522 Apr 25, 2023

CVE-2023-28086 5.5 MEDIUM EPSS 0.00

An HPE OneView appliance dump may expose proxy credential settings

CWE-522 Apr 25, 2023

CVE-2023-30776 4.9 MEDIUM EPSS 0.00

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

CWE-522 Apr 24, 2023

CVE-2023-28131 9.6 CRITICAL EPSS 0.01

A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).

CWE-522 Apr 24, 2023

CVE-2021-33589 7.5 HIGH EPSS 0.00

Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.

CWE-522 Apr 21, 2023

CVE-2023-25760 8.8 HIGH EPSS 0.00

Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request payload

CWE-522 Apr 19, 2023

CVE-2022-4308 6.1 MEDIUM EPSS 0.00

Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.

CWE-522 Apr 19, 2023

CVE-2023-25413 7.5 HIGH EPSS 0.00

Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials.

CWE-522 Apr 11, 2023

CVE-2023-25407 7.2 HIGH EPSS 0.00

Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.

CWE-522 Apr 11, 2023

CVE-2023-1574 6.5 MEDIUM EPSS 0.00

Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.

CWE-522 Apr 02, 2023

CVE-2022-48433 6.1 MEDIUM EPSS 0.00

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

CWE-522 Mar 29, 2023

CVE-2023-1518 7.8 HIGH EPSS 0.00

CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected.  

CWE-522 Mar 28, 2023

CVE-2023-1137 6.5 MEDIUM EPSS 0.00

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.

CWE-522 Mar 27, 2023

CVE-2023-25686 6.2 MEDIUM EPSS 0.00

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.

CWE-522 Mar 21, 2023

CVE-2023-0457 7.5 HIGH EPSS 0.02

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.

CWE-522 Mar 03, 2023

CVE-2022-45599 9.8 CRITICAL 1 PoC Analysis EPSS 0.01

Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts hashed password.

CWE-522 Feb 22, 2023

CVE-2022-41614 5.5 MEDIUM EPSS 0.00

Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enable information disclosure via local access.

CWE-522 Feb 16, 2023

CVE-2022-40678 7.4 HIGH EPSS 0.00

An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.

CWE-522 Feb 16, 2023

CVE-2022-43969 9.1 CRITICAL EPSS 0.00

Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.

CWE-522 Feb 16, 2023

CVE-2023-24498 7.5 HIGH EPSS 0.00

An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.

CWE-522 Feb 15, 2023