Overview 69 matches · 3 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
69matches
3in Waratek scope4.3%
0protected0.0%
1exploited1.4%
1CISA KEV1.4%
1public PoC1.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
4.3%
Outside Waratek scope
3
4.3%
Not applicable
63
91.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
69
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 16 / year
20171
Outside Waratek scope1
High1
not blocked1
No public exploit1
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20194
No exploit published1
Not applicable3
High1
Medium3
not blocked4
No public exploit4
20202
Not applicable2
Medium2
not blocked2
No public exploit2
20214
Outside Waratek scope1
Not applicable3
High2
Medium2
not blocked4
No public exploit4
20224
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20238
No exploit published1
Not applicable7
Critical1
High4
Medium3
not blocked8
No public exploit8
202413
Not applicable13
High4
Medium7
Low2
not blocked13
No public exploit13
202516
No exploit published1
Outside Waratek scope1
Not applicable14
Critical1
High9
Medium5
Low1
not blocked16
Working exploit published1
Proof of concept only2
No public exploit13
202616
Not applicable16
Critical2
High5
Medium9
not blocked16
Exploited1
Proof of concept only1
No public exploit14
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-28745 | Critical | 2026-10-09 | Not applicable | No public exploit | Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system. |
| CVE-2026-103548 | Medium | 2026-09-30 | Not applicable | No public exploit | Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user. |
| CVE-2026-69297 | Medium | 2026-09-08 | Not applicable | No public exploit | Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-80176 | Medium | 2026-09-07 | Not applicable | No public exploit | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure. |
| CVE-2026-65309 | High | 2026-07-31 | Not applicable | No public exploit | ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords. |
| CVE-2026-1836 | Medium | 2026-06-12 | Not applicable | No public exploit | The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials. |
| CVE-2026-22576 | Medium | 2026-04-14 | Not applicable | No public exploit | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. |
| CVE-2026-22574 | Medium | 2026-04-14 | Not applicable | No public exploit | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration. |
| CVE-2025-8095 | Critical | 2026-04-14 | Not applicable | No public exploit | The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption. |
| CVE-2016-15058 | High | 2026-04-03 | Not applicable | No public exploit | Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches. |
| CVE-2026-22614 | Medium | 2026-03-10 | Not applicable | No public exploit | The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre. |
| CVE-2026-30785 | High | 2026-03-05 | Not applicable | Proof of concept only | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id(). This issue affects RustDesk Client: through 1.4.5. |
| CVE-2026-20128 | High | 2026-02-25 | Not applicable | Exploited | A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. |
| CVE-2025-57796 | Medium | 2026-01-28 | Not applicable | No public exploit | Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained. |
| CVE-2025-14295 | High | 2026-01-22 | Not applicable | No public exploit | Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability (CWE-257) in the Web session management component allows an attacker to access stored passwords in a recoverable format which makes them subject to password reuse attacks by malicious users.This issue affects WebCTRL: from 6.0 through 9.0; i-Vu: from 6.0 through 9.0. |
| CVE-2025-8307 | Medium | 2026-01-08 | Not applicable | No public exploit | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0 |
| CVE-2025-34180 | High | 2025-12-15 | Not applicable | Proof of concept only | NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key. |
| CVE-2025-40774 | Medium | 2025-10-14 | Outside Waratek scope | No public exploit | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing them to recover passwords. Successful exploitation of this vulnerability allows an attacker to obtain and use valid user passwords. This can lead to unauthorized access to user accounts, data breaches, and potential system compromise. |
| CVE-2025-35054 | Medium | 2025-10-09 | Not applicable | No public exploit | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources. |
| CVE-2025-0280 | High | 2025-09-03 | Not applicable | No public exploit | A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access. |
| CVE-2025-58049 | High | 2025-08-28 | No exploit published | No public exploit | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1. |
| CVE-2025-57789 | Medium | 2025-08-20 | Not applicable | Working exploit published | During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured. |
| CVE-2025-8904 | Critical | 2025-08-13 | Not applicable | No public exploit | Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below. |
| CVE-2025-44958 | High | 2025-08-04 | Not applicable | No public exploit | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. |
| CVE-2025-6996 | High | 2025-07-08 | Not applicable | No public exploit | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords. |
| CVE-2025-6995 | High | 2025-07-08 | Not applicable | No public exploit | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords. |
| CVE-2025-27459 | High | 2025-07-03 | Not applicable | No public exploit | The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. |
| CVE-2024-51552 | High | 2025-05-22 | Not applicable | No public exploit | Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. |
| CVE-2025-25983 | Low | 2025-04-18 | Not applicable | Proof of concept only | An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component. |
| CVE-2024-32122 | Medium | 2025-04-08 | Not applicable | No public exploit | A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server. |
| CVE-2025-24852 | Medium | 2025-03-31 | Not applicable | No public exploit | Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password. |
| CVE-2024-8774 | High | 2025-03-24 | Not applicable | No public exploit | The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched. |
| CVE-2024-32151 | Medium | 2024-11-26 | Not applicable | No public exploit | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. |
| CVE-2024-20462 | Medium | 2024-10-16 | Not applicable | No public exploit | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML content from an affected device. A successful exploit could allow the attacker to view passwords that belong to other users. |
| CVE-2024-45744 | Medium | 2024-09-27 | Not applicable | No public exploit | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets. |
| CVE-2024-6694 | Low | 2024-07-20 | Not applicable | No public exploit | The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment. |
| CVE-2024-32932 | Medium | 2024-07-02 | Not applicable | No public exploit | Under certain circumstances the web interface users credentials may be recovered by an authenticated user. |
| CVE-2024-32756 | Medium | 2024-07-02 | Not applicable | No public exploit | Under certain circumstances the Linux users credentials may be recovered by an authenticated user. |
| CVE-2024-3073 | Low | 2024-06-13 | Not applicable | No public exploit | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment. |
| CVE-2024-32042 | High | 2024-05-15 | Not applicable | No public exploit | The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwords to be recovered. |
| CVE-2023-42955 | Medium | 2024-05-14 | Not applicable | No public exploit | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket. |
| CVE-2024-3543 | High | 2024-05-02 | Not applicable | No public exploit | Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system. |
| CVE-2024-1480 | High | 2024-04-19 | Not applicable | No public exploit | Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication. |
| CVE-2023-38738 | High | 2024-01-19 | Not applicable | No public exploit | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is using Native authentication an attacker with access to the OpenPages database could through a series of specially crafted steps could exploit this weakness and gain unauthorized access to other OpenPages accounts. IBM X-Force ID: 262594. |
| CVE-2023-31001 | Medium | 2024-01-11 | Not applicable | No public exploit | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653. |
| CVE-2023-5627 | High | 2023-11-01 | Not applicable | No public exploit | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized access to the web service. |
| CVE-2023-2358 | Medium | 2023-09-27 | No exploit published | No public exploit | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext. |
| CVE-2022-47376 | High | 2023-06-13 | Not applicable | No public exploit | The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data. |
| CVE-2023-2881 | Medium | 2023-05-25 | Not applicable | No public exploit | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
| CVE-2023-31150 | High | 2023-05-10 | Not applicable | No public exploit | A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11-15 for more details. |
| CVE-2023-23382 | Medium | 2023-02-14 | Not applicable | No public exploit | Azure Machine Learning Compute Instance Information Disclosure Vulnerability |
| CVE-2022-32519 | Critical | 2023-01-30 | Not applicable | No public exploit | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0) |
| CVE-2023-21726 | High | 2023-01-10 | Not applicable | No public exploit | Windows Credential Manager User Interface Elevation of Privilege Vulnerability |
| CVE-2022-46142 | Medium | 2022-12-13 | Not applicable | No public exploit | Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords. |
| CVE-2022-22251 | High | 2022-10-18 | Not applicable | No public exploit | On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX software deployment. This issue affects Juniper Networks Junos OS 20.2 version 20.2R1 and later versions prior to 21.2R1 on cSRX Series. |
| CVE-2022-34838 | High | 2022-08-24 | Not applicable | No public exploit | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be altered for the end user. |
| CVE-2022-34837 | Medium | 2022-08-24 | Not applicable | No public exploit | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon. |
| CVE-2021-35050 | High | 2021-06-25 | Not applicable | No public exploit | User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions. |
| CVE-2021-27485 | High | 2021-06-16 | Not applicable | No public exploit | ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser. |
| CVE-2020-8296 | Medium | 2021-03-03 | Not applicable | No public exploit | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. |
| CVE-2021-0220 | Medium | 2021-01-15 | Outside Waratek scope | No public exploit | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes, but is not limited to, obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1. |
| CVE-2019-18256 | Medium | 2020-06-29 | Not applicable | No public exploit | BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical access to the CardioMessenger can use these credentials for network authentication and decryption of local data in transit. |
| CVE-2019-19096 | Medium | 2020-04-02 | Not applicable | No public exploit | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality. |
| CVE-2019-3736 | High | 2019-09-27 | Not applicable | No public exploit | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt encrypted passwords stored locally on the system to use it to access other components using the privileges of the compromised user. |
| CVE-2019-1010241 | Medium | 2019-07-19 | No exploit published | No public exploit | Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job. |
| CVE-2019-6567 | Medium | 2019-06-12 | Not applicable | No public exploit | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords. |
| CVE-2019-5615 | Medium | 2019-04-09 | Not applicable | No public exploit | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49. |
| CVE-2018-5446 | Medium | 2018-05-04 | Not applicable | No public exploit | Medtronic 2090 CareLink Programmer uses a per-product username and password that is stored in a recoverable format. |
| CVE-2017-9942 | High | 2017-08-08 | Outside Waratek scope | No public exploit | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated server or SiPass integrated client to potentially obtain credentials from the systems. |