CVE & Exploit Intelligence Database

CVE-2021-36318 6.7 MEDIUM EPSS 0.00

Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage.

CWE-522 Dec 21, 2021

CVE-2021-36317 6.7 MEDIUM EPSS 0.00

Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.

CWE-522 Dec 21, 2021

CVE-2021-42913 7.5 HIGH 1 PoC Analysis EPSS 0.01

The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML source code. Authentication is not required.

CWE-522 Dec 20, 2021

CVE-2021-3179 5.5 MEDIUM 1 Writeup EPSS 0.00

GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass.

CWE-522 Dec 16, 2021

CVE-2021-45097 2.9 LOW 1 Writeup EPSS 0.00

KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content.

CWE-522 Dec 16, 2021

CVE-2021-42023 6.5 MEDIUM EPSS 0.00

A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property (IP) data in accordance with the IEEE 1735 recommended practice. This could allow a sophisticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice.

CWE-522 Dec 14, 2021

CVE-2021-40857 8.8 HIGH EPSS 0.01

Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.

CWE-522 Dec 13, 2021

CVE-2021-37187 6.5 MEDIUM EPSS 0.00

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.

CWE-522 Dec 10, 2021

CVE-2021-20146 9.8 CRITICAL EPSS 0.01

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon's development and infrastructure. At the time of discovery, the ssh key could be used to login to the development server hosted in Amazon Web Services.

CWE-522 Dec 09, 2021

CVE-2021-43978 7.1 HIGH EPSS 0.00

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.

CWE-522 Dec 08, 2021

CVE-2020-27413 4.2 MEDIUM EPSS 0.00

An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is logged into the application.

CWE-522 Dec 07, 2021

CVE-2021-42306 8.1 HIGH EPSS 0.09

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

CWE-522 Nov 24, 2021

CVE-2021-38976 5.5 MEDIUM EPSS 0.00

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.

CWE-522 Nov 15, 2021

CVE-2021-3789 4.2 MEDIUM EPSS 0.00

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.

CWE-522 Nov 12, 2021

CVE-2021-43332 6.5 MEDIUM EPSS 0.00

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.

CWE-522 Nov 12, 2021

CVE-2021-41972 6.5 MEDIUM EPSS 0.00

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

CWE-522 Nov 12, 2021

CVE-2021-43397 8.8 HIGH EPSS 0.18

LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.

CWE-522 Nov 11, 2021

CVE-2021-40503 7.8 HIGH EPSS 0.00

An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.

CWE-522 Nov 10, 2021

CVE-2021-41023 5.5 MEDIUM EPSS 0.00

A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files

CWE-522 Nov 02, 2021

CVE-2020-23036 5.9 MEDIUM EPSS 0.00

MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack.

CWE-522 Oct 22, 2021