Overview 38 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
2.6%
Not applicable
37
97.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
38
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
38
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 9 / year
20001
Not applicable1
Critical1
not blocked1
Working exploit published1
20010
20020
20030
20040
20050
20060
20071
Not applicable1
Critical1
not blocked1
Working exploit published1
20080
20090
20100
20110
20120
20131
Not applicable1
Medium1
not blocked1
Working exploit published1
20140
20150
20160
20174
Not applicable4
Critical2
High2
not blocked4
Working exploit published4
20186
Not applicable6
Critical3
High3
not blocked6
Working exploit published6
20192
Not applicable2
High2
not blocked2
Working exploit published2
20209
Not applicable9
Critical4
High4
Medium1
not blocked9
Working exploit published9
20210
20224
Not applicable4
Critical2
High1
Medium1
not blocked4
Working exploit published4
20232
Not applicable2
Medium2
not blocked2
Working exploit published2
20242
Not applicable2
High2
not blocked2
Working exploit published2
20254
Not applicable4
Critical1
High3
not blocked4
Working exploit published4
20262
Outside Waratek scope1
Not applicable1
Critical1
High1
not blocked2
Working exploit published2
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-54617 | Critical | 2026-09-17 | Outside Waratek scope | Working exploit published | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12. |
| CVE-2026-57219 | High | 2026-07-10 | Not applicable | Working exploit published | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. |
| CVE-2025-34078 | High | 2025-07-02 | Not applicable | Working exploit published | A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API. This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions. |
| CVE-2025-28228 | High | 2025-04-18 | Not applicable | Working exploit published | A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext. |
| CVE-2025-25570 | Critical | 2025-02-27 | Not applicable | Working exploit published | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
| CVE-2024-23733 | High | 2025-01-29 | Not applicable | Working exploit published | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI. |
| CVE-2024-51546 | High | 2024-12-05 | Not applicable | Working exploit published | Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 |
| CVE-2023-6421 | High | 2024-01-01 | Not applicable | Working exploit published | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
| CVE-2023-36266 | Medium | 2023-07-12 | Not applicable | Working exploit published | An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information). |
| CVE-2022-47880 | Medium | 2023-05-12 | Not applicable | Working exploit published | An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function. |
| CVE-2022-37109 | Critical | 2022-11-14 | Not applicable | Working exploit published | patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie. |
| CVE-2022-35411 | Critical | 2022-07-08 | Not applicable | Working exploit published | rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle. |
| CVE-2022-29457 | High | 2022-04-18 | Not applicable | Working exploit published | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps. |
| CVE-2021-44451 | Medium | 2022-02-01 | Not applicable | Working exploit published | Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher. |
| CVE-2020-14930 | High | 2020-06-19 | Not applicable | Working exploit published | An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client. |
| CVE-2020-7030 | Medium | 2020-06-04 | Not applicable | Working exploit published | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3. |
| CVE-2020-11560 | High | 2020-04-07 | Not applicable | Working exploit published | NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file. |
| CVE-2013-7055 | Critical | 2020-02-04 | Not applicable | Working exploit published | D-Link DIR-100 4.03B07 has PPTP and poe information disclosure |
| CVE-2013-7052 | Critical | 2020-02-04 | Not applicable | Working exploit published | D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script |
| CVE-2019-19823 | High | 2020-01-27 | Not applicable | Working exploit published | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12. |
| CVE-2014-6039 | High | 2020-01-13 | Not applicable | Working exploit published | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. |
| CVE-2014-5381 | Critical | 2020-01-13 | Not applicable | Working exploit published | Grand MA 300 allows a brute-force attack on the PIN. |
| CVE-2014-5093 | Critical | 2020-01-10 | Not applicable | Working exploit published | Status2k does not remove the install directory allowing credential reset. |
| CVE-2019-11369 | High | 2019-06-03 | Not applicable | Working exploit published | An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device. |
| CVE-2019-0881 | High | 2019-05-16 | Not applicable | Working exploit published | An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerability'. |
| CVE-2018-11742 | Critical | 2018-12-26 | Not applicable | Working exploit published | NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. |
| CVE-2018-10824 | Critical | 2018-10-17 | Not applicable | Working exploit published | An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0 file. An attacker having a directory traversal (or LFI) can easily get full router access. |
| CVE-2018-10814 | High | 2018-09-14 | Not applicable | Working exploit published | Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials. |
| CVE-2018-10286 | High | 2018-04-22 | Not applicable | Working exploit published | The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs to be authenticated. |
| CVE-2018-9160 | Critical | 2018-03-31 | Not applicable | Working exploit published | SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. |
| CVE-2018-5708 | High | 2018-03-30 | Not applicable | Working exploit published | An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML. |
| CVE-2017-15918 | High | 2017-11-01 | Not applicable | Working exploit published | Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks. |
| CVE-2017-8837 | Critical | 2017-06-05 | Not applicable | Working exploit published | Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems. |
| CVE-2017-7925 | Critical | 2017-05-06 | Not applicable | Working exploit published | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information. |
| CVE-2017-6528 | High | 2017-03-09 | Not applicable | Working exploit published | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file). |
| CVE-2012-5627 | Medium | 2013-10-01 | Not applicable | Working exploit published | Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks. |
| CVE-2007-0681 | Critical | 2007-02-03 | Not applicable | Working exploit published | profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php. |
| CVE-2000-0944 | Critical | 2000-12-19 | Not applicable | Working exploit published | CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, which allows remote attackers to modify the password without knowing the original password. |