CVE & Exploit Intelligence Database

CVE-2019-15653 7.5 HIGH EPSS 0.01

Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).

CWE-522 Mar 19, 2020

CVE-2020-9324 7.5 HIGH EPSS 0.00

Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.

CWE-522 Mar 18, 2020

CVE-2019-13394 9.8 CRITICAL EPSS 0.00

The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.

CWE-319 Mar 13, 2020

CVE-2019-5648 6.5 MEDIUM EPSS 0.01

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware <= v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be used by any authenticated administrative user to expose the LDAP credentials configured in the LDAP connector over the network.

CWE-522 Mar 12, 2020

CVE-2019-9104 7.5 HIGH EPSS 0.00

An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. The application's configuration file contains parameters that represent passwords in cleartext.

CWE-522 Mar 11, 2020

CVE-2019-10705 7.5 HIGH EPSS 0.00

Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted without knowledge of proper authentication credentials.

CWE-522 Mar 10, 2020

CVE-2019-11686 5.5 MEDIUM EPSS 0.00

Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive parameters (such as data encryption keys) to remain on the drive media after their intended erasure.

CWE-522 Mar 10, 2020

CVE-2019-10706 6.3 MEDIUM EPSS 0.00

Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices.

CWE-522 Mar 10, 2020

CVE-2020-2145 5.5 MEDIUM EPSS 0.00

Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.

CWE-522 Mar 09, 2020

CVE-2020-5404 5.9 MEDIUM EPSS 0.00

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

CWE-522 Mar 03, 2020

CVE-2020-6794 6.5 MEDIUM EPSS 0.00

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.

CWE-522 Mar 02, 2020

CVE-2020-3841 6.5 MEDIUM EPSS 0.00

The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.

CWE-319 Feb 27, 2020

CVE-2020-5400 6.5 MEDIUM EPSS 0.00

Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.

CWE-522 Feb 27, 2020

CVE-2014-4659 5.5 MEDIUM 1 Writeup EPSS 0.00

Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.

CWE-522 Feb 20, 2020

CVE-2014-4660 5.5 MEDIUM EPSS 0.00

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

CWE-522 Feb 20, 2020

CVE-2020-2133 6.5 MEDIUM EPSS 0.00

Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Feb 12, 2020

CVE-2020-2132 6.5 MEDIUM EPSS 0.00

Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Feb 12, 2020

CVE-2020-2131 6.5 MEDIUM EPSS 0.00

Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Feb 12, 2020

CVE-2020-2130 6.5 MEDIUM EPSS 0.00

Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

CWE-522 Feb 12, 2020

CVE-2020-2129 6.5 MEDIUM EPSS 0.00

Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

CWE-522 Feb 12, 2020