CVE & Exploit Intelligence Database

CVE-2017-12123 8.8 HIGH EPSS 0.00

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An attacker can look at network traffic to get the admin password for the device. The attacker can then use the credentials to login as admin.

CWE-522 May 14, 2018

CVE-2018-6618 7.8 HIGH EPSS 0.00

Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage.

CWE-522 May 11, 2018

CVE-2018-5446 4.9 MEDIUM EPSS 0.00

Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format.

CWE-522 May 04, 2018

CVE-2018-1074 7.7 HIGH EPSS 0.00

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

CWE-522 Apr 26, 2018

CVE-2017-9654 8.8 HIGH EPSS 0.00

The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3 base score: 6.5, CVSS vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

CWE-522 Apr 24, 2018

CVE-2017-1764 7.0 HIGH EPSS 0.00

IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM X-Force ID: 136149.

CWE-522 Apr 23, 2018

CVE-2018-10286 8.8 HIGH 1 PoC Analysis EPSS 0.04

The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated.

CWE-522 Apr 22, 2018

CVE-2016-9593 4.7 MEDIUM EPSS 0.00

foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view passwords, allowing them to access those systems.

CWE-522 Apr 16, 2018

CVE-2018-10024 9.8 CRITICAL 1 PoC Analysis EPSS 0.01

ubiQuoss Switch VP5208A creates a bcm_password file at /cgi-bin/ with the user credentials in cleartext when a failed login attempt occurs. The file can be reached via an HTTP request. The credentials can be used to access the system via SSH (or TELNET if it is enabled).

CWE-522 Apr 11, 2018

CVE-2018-4170 7.8 HIGH EPSS 0.00

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Admin Framework" component. It allows local users to discover a password by listing a process and its arguments during sysadminctl execution.

CWE-522 Apr 03, 2018

CVE-2018-9160 9.8 CRITICAL 3 PoCs Analysis EPSS 0.71

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

CWE-522 Mar 31, 2018

CVE-2018-5708 8.0 HIGH 2 PoCs Analysis EPSS 0.06

An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML.

CWE-522 Mar 30, 2018

CVE-2018-9031 9.8 CRITICAL EPSS 0.01

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.

CWE-522 Mar 29, 2018

CVE-2017-11510 9.8 CRITICAL EPSS 0.01

An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password via an ONVIF GetSnapshotUri request.

CWE-522 Mar 28, 2018

CVE-2017-0925 7.2 HIGH EPSS 0.00

Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information disclosure of plaintext password.

CWE-319 Mar 21, 2018

CVE-2018-1000104 7.8 HIGH EPSS 0.00

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.

CWE-522 Mar 13, 2018

CVE-2018-7698 8.1 HIGH EPSS 0.00

An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password for connected D-Link cameras (such as DCS-933L and DCS-934L) unencrypted from the app to the camera, allowing attackers to obtain these credentials and gain control of the camera including the ability to view the camera's stream and make changes without the user's knowledge.

CWE-522 Mar 05, 2018

CVE-2017-5189 4.3 MEDIUM EPSS 0.00

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance.

CWE-522 Mar 02, 2018

CVE-2018-1377 7.8 HIGH EPSS 0.00

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778.

CWE-522 Feb 26, 2018

CVE-2018-3609 8.1 HIGH EPSS 0.16

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.

CWE-522 Feb 16, 2018