Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 46

Export CSV
CVE-2020-10275

RVD#2565: Weak token generation for the REST API.

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Easyrobotics Mobile-industrial-robots Uvd-robots
Products
Er-flex Er-flex Firmware Er-lite and 17 more
CVE-2013-1053

Insecure crypto for storing passwords

In crypt.c of remote-login-service, the cryptographic algorithm used to cache usernames and passwords is insecure. An attacker could use this vulnerability to recover usernames and passwords from the file. This issue affects version 1.0.0-0ubuntu3 and prior versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Remote-login-service
CVE-2024-45394

Secret encryption vulnerable to brute-force attacks

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Authenticator Authenticator-extension
Products
Authenticator Authenticator
CVE-2024-34542

Advantech ADAM-5630 Weak Encoding for Password

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-5630 Adam-5630 Firmware
CVE-2024-37187

Advantech ADAM-5550 Weak Encoding for Password

Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-5550 Adam-5550 Firmware
CVE-2024-8455

PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets can directly crack them to obtain plaintext passwords.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Planet Planet Technology Corp
Products
Gs-4210-24p2s Gs-4210-24p2s Firmware Gs-4210-24pl4c and 6 more