CVE & Exploit Intelligence Database

CVE-2022-27560 6.0 MEDIUM EPSS 0.00

HCL VersionVault Express exposes administrator credentials.

CWE-522 Aug 30, 2022

CVE-2022-0718 4.9 MEDIUM EPSS 0.00

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

CWE-522 Aug 29, 2022

CVE-2021-20260 7.8 HIGH EPSS 0.00

A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CWE-522 Aug 26, 2022

CVE-2021-43767 5.9 MEDIUM EPSS 0.00

Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL.

CWE-295 Aug 25, 2022

CVE-2022-34838 8.1 HIGH EPSS 0.00

Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be altered for the end user.

CWE-522 Aug 24, 2022

CVE-2022-34837 6.2 MEDIUM EPSS 0.00

Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.

CWE-522 Aug 24, 2022

CVE-2022-38665 6.5 MEDIUM EPSS 0.00

Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CWE-522 Aug 23, 2022

CVE-2022-38663 6.5 MEDIUM EPSS 0.02

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.

CWE-522 Aug 23, 2022

CVE-2020-35992 6.5 MEDIUM 1 Writeup EPSS 0.00

Fiserv Prologue through 2020-12-16 does not properly protect the database password. If an attacker were to gain access to the configuration file (specifically, the LogPassword attribute within appconfig.ini), they would be able to decrypt the password stored within the configuration file. This would yield cleartext credentials for the database (to gain access to financial records of customers stored within the database), and in some cases would allow remote login to the database.

CWE-522 Aug 23, 2022

CVE-2021-3513 7.5 HIGH EPSS 0.00

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.

CWE-522 Aug 22, 2022

CVE-2022-30944 5.5 MEDIUM EPSS 0.00

Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via local access.

CWE-522 Aug 18, 2022

CVE-2022-30601 9.8 CRITICAL EPSS 0.02

Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access.

CWE-522 Aug 18, 2022

CVE-2022-30296 7.5 HIGH EPSS 0.01

Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially enable information disclosure via network access.

CWE-522 Aug 18, 2022

CVE-2022-29507 5.5 MEDIUM EPSS 0.00

Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access.

CWE-522 Aug 18, 2022

CVE-2022-26844 7.8 HIGH EPSS 0.00

Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

CWE-522 Aug 18, 2022

CVE-2020-10710 4.4 MEDIUM EPSS 0.00

A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.

CWE-522 Aug 16, 2022

CVE-2022-29959 5.5 MEDIUM EPSS 0.00

Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.

CWE-522 Aug 16, 2022

CVE-2022-36308 9.1 CRITICAL EPSS 0.00

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may affect other AirVelocity and AirSpeed models.

CWE-522 Aug 16, 2022

CVE-2022-36307 6.8 MEDIUM EPSS 0.00

The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models.

CWE-522 Aug 16, 2022

CVE-2022-22983 5.9 MEDIUM EPSS 0.00

VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.

CWE-522 Aug 10, 2022