CWE-312 Archives - CVE Vulnerability

CVE-2008-7272

Sun, 26 Feb 2023 09:11:57 +0000

FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user’s passphrase to disk which may result in the compromise of secure communication or a users’s private key.

The post CVE-2008-7272 appeared first on CVE Vulnerability.

CVE-2008-6828

Sun, 26 Feb 2023 09:11:43 +0000

Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server.

The post CVE-2008-6828 appeared first on CVE Vulnerability.

CVE-2008-6157

Sun, 26 Feb 2023 09:11:22 +0000

SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information.

The post CVE-2008-6157 appeared first on CVE Vulnerability.

CVE-2008-1567

Sun, 26 Feb 2023 09:09:05 +0000

phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.

The post CVE-2008-1567 appeared first on CVE Vulnerability.

CVE-2008-0174

Sun, 26 Feb 2023 09:08:25 +0000

GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the passwords and gain privileges.

The post CVE-2008-0174 appeared first on CVE Vulnerability.

CVE-2007-5778

Sun, 26 Feb 2023 09:07:51 +0000

Mobile Spy (1) stores login credentials in cleartext under the RetinaxStudios registry key, and (2) sends login credentials and log data over a cleartext HTTP connection, which allows attackers to obtain sensitive information by reading the registry or sniffing the network.

The post CVE-2007-5778 appeared first on CVE Vulnerability.

CVE-2018-9065

Sun, 26 Feb 2023 06:51:43 +0000

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.

The post CVE-2018-9065 appeared first on CVE Vulnerability.

CVE-2018-8947

Sun, 26 Feb 2023 06:51:40 +0000

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

The post CVE-2018-8947 appeared first on CVE Vulnerability.

CVE-2018-5559

Sun, 26 Feb 2023 06:50:23 +0000

In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.

The post CVE-2018-5559 appeared first on CVE Vulnerability.

CVE-2018-20008

Sun, 26 Feb 2023 06:48:25 +0000

iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain text) and the web-console password (base64) via the debugging console.

The post CVE-2018-20008 appeared first on CVE Vulnerability.