WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-312✕
Overview 16 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
16matches 2in Waratek scope12.5% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.512.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 12.5% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 87.5% Withdrawn CVE 0 0.0%
Critical 3 18.8% High 11 68.8% Medium 2 12.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 16 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 14Mitigation candidate: 2 Medium: 2High: 11Critical: 3 not blocked: 16 Working exploit published: 16
20092 Not applicable2 High2 not blocked2 Working exploit published2 20100 20110 20120 20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20140 20150 20160 20170 20183 Not applicable3 High2 Medium1 not blocked3 Working exploit published3 20191 Not applicable1 Critical1 not blocked1 Working exploit published1 20203 Not applicable3 High3 not blocked3 Working exploit published3 20212 Not applicable2 High2 not blocked2 Working exploit published2 20221 Not applicable1 Critical1 not blocked1 Working exploit published1 20232 Mitigation candidate1 Not applicable1 Critical1 High1 not blocked2 Working exploit published2 20241 Not applicable1 High1 not blocked1 Working exploit published1
20102012201420162018202020222024
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-3742 High 2024-04-18 Not applicable Working exploit published Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.
CVE-2023-50719 High 2023-12-15 Mitigation candidate Working exploit published XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text. This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.
CVE-2023-31069 Critical 2023-09-11 Not applicable Working exploit published An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page.
CVE-2022-26148 Critical 2022-03-21 Not applicable Working exploit published An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
CVE-2021-31581 High 2021-07-22 Not applicable Working exploit published The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
CVE-2021-28937 High 2021-03-29 Not applicable Working exploit published The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.
CVE-2020-10532 High 2020-03-12 Not applicable Working exploit published The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI.
CVE-2013-2680 High 2020-02-05 Not applicable Working exploit published Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.
CVE-2009-5068 High 2020-01-15 Not applicable Working exploit published There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.
CVE-2019-0285 Critical 2019-04-10 Not applicable Working exploit published The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
CVE-2018-11242 Medium 2018-05-20 Not applicable Working exploit published An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files.
CVE-2016-8366 High 2018-04-05 Not applicable Working exploit published Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text.
CVE-2018-8947 High 2018-03-25 Not applicable Working exploit published rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
CVE-2013-5676 Medium 2013-12-13 Mitigation candidate Working exploit published The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.
CVE-2009-0964 High 2009-03-19 Not applicable Working exploit published UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. NOTE: this can be leveraged with a separate SQL injection vulnerability to obtain passwords remotely without authentication.
CVE-2008-6157 High 2009-02-17 Not applicable Working exploit published SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information.