CVE & Exploit Intelligence Database

CVE-2018-21031 6.5 MEDIUM EPSS 0.00

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product.

CWE-522 Nov 18, 2019

CVE-2019-3663 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of High, further investigation has resulted in this being updated to Critical. The root password is common across all instances of ATD prior to 4.8. See the Security bulletin for further details

CWE-522 Nov 14, 2019

CVE-2019-1384 9.9 CRITICAL EPSS 0.03

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'.

CWE-522 Nov 12, 2019

CVE-2010-4178 5.5 MEDIUM EPSS 0.00

MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console

CWE-522 Nov 06, 2019

CVE-2016-4401 9.8 CRITICAL EPSS 0.00

Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.

CWE-522 Nov 06, 2019

CVE-2013-4423 5.5 MEDIUM EPSS 0.00

CloudForms stores user passwords in recoverable format

CWE-522 Nov 04, 2019

CVE-2019-10210 7.0 HIGH EPSS 0.00

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.

CWE-522 Oct 29, 2019

CVE-2019-4307 5.5 MEDIUM EPSS 0.00

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 160987.

CWE-522 Oct 29, 2019

CVE-2019-14929 9.8 CRITICAL EPSS 0.02

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service.

CWE-522 Oct 28, 2019

CVE-2019-10476 7.8 HIGH EPSS 0.00

Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

CWE-522 Oct 23, 2019

CVE-2019-10467 6.5 MEDIUM EPSS 0.00

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Oct 23, 2019

CVE-2019-10461 7.8 HIGH EPSS 0.00

Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

CWE-522 Oct 23, 2019

CVE-2019-10460 7.8 HIGH EPSS 0.00

Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

CWE-522 Oct 23, 2019

CVE-2019-10459 6.5 MEDIUM EPSS 0.00

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Oct 23, 2019

CVE-2019-17393 9.8 CRITICAL EPSS 0.00

The Customer's Tomedo Server in Version 1.7.3 communicates to the Vendor Tomedo Server via HTTP (in cleartext) that can be sniffed by unauthorized actors. Basic authentication is used for the authentication, making it possible to base64 decode the sniffed credentials and discover the username and password.

CWE-319 Oct 18, 2019

CVE-2019-11284 8.6 HIGH EPSS 0.00

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

CWE-522 Oct 17, 2019

CVE-2019-17662 9.8 CRITICAL 9 PoCs Analysis NUCLEI EPSS 0.94

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.

CWE-22 Oct 16, 2019

CVE-2019-10448 8.8 HIGH EPSS 0.00

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

CWE-522 Oct 16, 2019

CVE-2019-17356 6.5 MEDIUM EPSS 0.00

The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrated by sniffing of a public Wi-Fi network.

CWE-319 Oct 15, 2019

CVE-2019-17497 6.5 MEDIUM 1 PoC Analysis EPSS 0.02

Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.

CWE-522 Oct 11, 2019