Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1288 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-4659 1 Redhat 1 Ansible 2024-11-21 5.5 Medium
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.
CVE-2014-3536 1 Redhat 1 Cloudforms Management Engine 2024-11-21 5.5 Medium
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3445 1 Handsomeweb 1 Sos Webpages 2024-11-21 9.8 Critical
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
CVE-2014-2581 2 Fedoraproject, Smb4k Project 2 Fedora, Smb4k 2024-11-21 7.5 High
Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.
CVE-2014-1423 2 Signond Project, Ubports 2 Signond, Ubuntu Touch 2024-11-21 5.9 Medium
signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
CVE-2014-0241 2 Redhat, Theforeman 2 Satellite, Hammer Cli 2024-11-21 5.5 Medium
rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable
CVE-2013-7055 1 Dlink 2 Dir-100, Dir-100 Firmware 2024-11-21 9.8 Critical
D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
CVE-2013-7052 1 Dlink 2 Dir-100, Dir-100 Firmware 2024-11-21 9.8 Critical
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
CVE-2013-5113 1 Logmein 1 Lastpass 2024-11-21 6.8 Medium
LastPass prior to 2.5.1 has an insecure PIN implementation.
CVE-2013-4423 1 Redhat 2 Cloudforms, Cloudforms Managementengine 2024-11-21 5.5 Medium
CloudForms stores user passwords in recoverable format
CVE-2013-3620 2 Citrix, Supermicro 10 Netscaler, Netscaler Firmware, Netscaler Sd-wan and 7 more 2024-11-21 7.5 High
Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312.
CVE-2013-3313 1 Loftek 2 Nexus 543, Nexus 543 Firmware 2024-11-21 7.5 High
The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311.
CVE-2013-2672 1 Brother 2 Mfc-9970cdw, Mfc-9970cdw Firmware 2024-11-21 7.5 High
Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.
CVE-2013-2106 2 Debian, Stanford 2 Debian Linux, Webauth 2024-11-21 7.5 High
webauth before 4.6.1 has authentication credential disclosure
CVE-2012-6663 1 Ge 4 D200, D200 Firmware, D20me and 1 more 2024-11-21 7.5 High
General Electric D20ME devices are not properly configured and reveal plaintext passwords.
CVE-2012-5527 1 Claws-mail 1 Vcalendar 2024-11-21 5.5 Medium
Claws Mail vCalendar plugin: credentials exposed on interface
CVE-2012-3823 1 Arialsoftware 1 Campaign Enterprise 2024-11-21 7.5 High
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
CVE-2010-4178 2 Fedoraproject, Oracle 2 Fedora, Mysql-gui-tools 2024-11-21 5.5 Medium
MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console
CVE-2010-2496 1 Clusterlabs 2 Cluster Glue, Pacemaker 2024-11-21 5.5 Medium
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
CVE-2024-47588 2024-11-12 4.7 Medium
In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.