CVE & Exploit Intelligence Database

CVE-2020-6195 9.8 CRITICAL EPSS 0.00

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system.

CWE-319 Apr 14, 2020

CVE-2020-11694 7.5 HIGH EPSS 0.00

In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.

CWE-522 Apr 10, 2020

CVE-2020-5406 6.5 MEDIUM EPSS 0.00

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

CWE-522 Apr 10, 2020

CVE-2020-5263 5.5 MEDIUM 1 Writeup EPSS 0.00

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3

CWE-522 Apr 09, 2020

CVE-2020-11557 7.5 HIGH EPSS 0.00

An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It includes the username and password values in cleartext within each request's cookie value.

CWE-319 Apr 09, 2020

CVE-2020-11555 7.5 HIGH EPSS 0.01

An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from backup files.

CWE-522 Apr 09, 2020

CVE-2020-1978 5.8 MEDIUM EPSS 0.00

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. This issue does not affect VM Series in non-HA configurations or on other cloud platforms. It does not affect hardware firewall appliances. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the tech support files with the credentials. We now filter and remove these credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.

CWE-522 Apr 08, 2020

CVE-2020-11629 7.2 HIGH EPSS 0.00

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to the CA UI could exploit this to upload malicious scripts to the server. (Risks associated with this issue alone are negligible unless a malicious user already has gained access to the CA UI through other means, as a trusted user is already trusted to upload scripts by virtue of having access to the validator.)

CWE-522 Apr 08, 2020

CVE-2020-11560 7.8 HIGH 1 PoC Analysis EPSS 0.02

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

CWE-522 Apr 07, 2020

CVE-2017-18695 6.5 MEDIUM EPSS 0.00

An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discover a user's credentials, during an email account login, via an EAS autodiscover packet. The Samsung ID is SVE-2016-7654 (January 2017).

CWE-522 Apr 07, 2020

CVE-2016-11029 7.5 HIGH EPSS 0.00

An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).

CWE-522 Apr 07, 2020

CVE-2019-19096 6.1 MEDIUM EPSS 0.00

The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.

CWE-522 Apr 02, 2020

CVE-2019-3942 7.5 HIGH EPSS 0.01

Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.

CWE-284 Apr 01, 2020

CVE-2020-11449 7.5 HIGH EPSS 0.00

An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf.

CWE-522 Apr 01, 2020

CVE-2020-2165 7.5 HIGH EPSS 0.00

Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

CWE-522 Mar 25, 2020

CVE-2020-2164 6.5 MEDIUM EPSS 0.00

Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

CWE-522 Mar 25, 2020

CVE-2019-18785 7.5 HIGH EPSS 0.00

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.

CWE-522 Mar 20, 2020

CVE-2019-16067 7.5 HIGH EPSS 0.00

NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication traffic in transit.

CWE-319 Mar 19, 2020

CVE-2019-15656 7.5 HIGH EPSS 0.01

D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of username_v and password_v variables.

CWE-522 Mar 19, 2020

CVE-2019-15655 7.5 HIGH EPSS 0.01

D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.

CWE-522 Mar 19, 2020