{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1552 Unsecured Credentials","home_page_url":"https://patchfirst.co/technique/T1552/","feed_url":"https://patchfirst.co/feed/technique/T1552.json","description":"New and newly exploited CVEs that lead to ATT&CK T1552 Unsecured Credentials, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-20128#kev","url":"https://patchfirst.co/cve/CVE-2026-20128/","title":"[KEV] CVE-2026-20128: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 7.3% (higher than 94.4% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 67.1 of 100.","summary":"Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T10:17:10.000Z","tags":["kev","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":67.1,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.07317,"percentile":0.94374},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-50224#kev","url":"https://patchfirst.co/cve/CVE-2023-50224/","title":"[KEV] CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","content_text":"TP-Link · TL-WR841N. In CISA KEV since 2025-09-03. ENISA EUVD lists it as exploited. EPSS 20.0% (higher than 97.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 62.0 of 100.","summary":"TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","date_published":"2025-09-03T00:00:00.000Z","date_modified":"2026-09-03T17:28:42.000Z","tags":["kev","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":62,"kev":{"dateAdded":"2025-09-03","ransomware":false},"epss":{"score":0.20021,"percentile":0.97436},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"TP-Link","product":"TL-WR841N","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-6693#kev","url":"https://patchfirst.co/cve/CVE-2019-6693/","title":"[KEV] CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2025-06-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 6.6% (higher than 93.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1555 Credentials from Password Stores. Priority 76.3 of 100.","summary":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","date_published":"2025-06-25T00:00:00.000Z","date_modified":"2026-08-04T05:16:27.000Z","tags":["kev","ransomware","public-exploit","T1552","T1555"],"_patchfirst":{"reason":"kev","priority":76.3,"kev":{"dateAdded":"2025-06-25","ransomware":true},"epss":{"score":0.0664,"percentile":0.93861},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1552","T1555"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-20439#kev","url":"https://patchfirst.co/cve/CVE-2024-20439/","title":"[KEV] CVE-2024-20439: Cisco Smart Licensing Utility Static Credential Vulnerability","content_text":"Cisco · Smart Licensing Utility. In CISA KEV since 2025-03-31. ENISA EUVD lists it as exploited. EPSS 97.1% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1106 Native API. Priority 69.8 of 100.","summary":"Cisco Smart Licensing Utility Static Credential Vulnerability","date_published":"2025-03-31T00:00:00.000Z","date_modified":"2026-06-17T07:07:06.000Z","tags":["kev","public-exploit","T1552","T1106"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-03-31","ransomware":false},"epss":{"score":0.9709,"percentile":0.99892},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Cisco","product":"Smart Licensing Utility","techniqueIds":["T1552","T1106"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-3272#kev","url":"https://patchfirst.co/cve/CVE-2024-3272/","title":"[KEV] CVE-2024-3272: D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability","content_text":"D-Link · Multiple NAS Devices. In CISA KEV since 2024-04-11. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 69.8 of 100.","summary":"D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability","date_published":"2024-04-11T00:00:00.000Z","date_modified":"2026-06-17T07:43:41.000Z","tags":["kev","public-exploit","T1552","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-04-11","ransomware":false},"epss":{"score":0.98109,"percentile":0.99912},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"D-Link","product":"Multiple NAS Devices","techniqueIds":["T1552","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-21887","url":"https://patchfirst.co/cve/CVE-2024-21887/","title":"CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","content_text":"Ivanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1552 Unsecured Credentials. Named in 4 threat reports. Priority 88.4 of 100.","summary":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","date_published":"2024-01-12T00:00:00.000Z","date_modified":"2026-08-04T05:16:30.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003","T1552"],"_patchfirst":{"reason":"published","priority":88.4,"kev":{"dateAdded":"2024-01-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Connect Secure and Policy Secure","techniqueIds":["T1190","T1059","T1505.003","T1552"],"reportCount":4,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-49103#kev","url":"https://patchfirst.co/cve/CVE-2023-49103/","title":"[KEV] CVE-2023-49103: ownCloud graphapi Information Disclosure Vulnerability","content_text":"ownCloud · ownCloud graphapi. In CISA KEV since 2023-11-30. ENISA EUVD lists it as exploited. EPSS 77.8% (higher than 99.57% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1552 Unsecured Credentials. Priority 68.2 of 100.","summary":"ownCloud graphapi Information Disclosure Vulnerability","date_published":"2023-11-30T00:00:00.000Z","date_modified":"2026-06-17T06:35:22.000Z","tags":["kev","public-exploit","T1190","T1005","T1552"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2023-11-30","ransomware":false},"epss":{"score":0.77755,"percentile":0.99568},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"ownCloud","product":"ownCloud graphapi","techniqueIds":["T1190","T1005","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-28432#kev","url":"https://patchfirst.co/cve/CVE-2023-28432/","title":"[KEV] CVE-2023-28432: MinIO Information Disclosure Vulnerability","content_text":"MinIO · MinIO. In CISA KEV since 2023-04-21. ENISA EUVD lists it as exploited. EPSS 84.0% (higher than 99.69% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 68.2 of 100.","summary":"MinIO Information Disclosure Vulnerability","date_published":"2023-04-21T00:00:00.000Z","date_modified":"2026-06-17T05:47:42.000Z","tags":["kev","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2023-04-21","ransomware":false},"epss":{"score":0.83957,"percentile":0.99692},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"MinIO","product":"MinIO","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-24990#kev","url":"https://patchfirst.co/cve/CVE-2022-24990/","title":"[KEV] CVE-2022-24990: TerraMaster OS Remote Command Execution Vulnerability","content_text":"TerraMaster · TerraMaster OS. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 78.2 of 100.","summary":"TerraMaster OS Remote Command Execution Vulnerability","date_published":"2023-02-10T00:00:00.000Z","date_modified":"2026-06-17T04:32:54.000Z","tags":["kev","ransomware","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2023-02-10","ransomware":true},"epss":{"score":0.83166,"percentile":0.99676},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"TerraMaster","product":"TerraMaster OS","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-5521#kev","url":"https://patchfirst.co/cve/CVE-2017-5521/","title":"[KEV] CVE-2017-5521: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability","content_text":"NETGEAR · Multiple Devices. In CISA KEV since 2022-09-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 68.6 of 100.","summary":"NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2026-06-17T01:20:39.000Z","tags":["kev","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2022-09-08","ransomware":false},"epss":{"score":0.89353,"percentile":0.99783},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"NETGEAR","product":"Multiple Devices","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2011-4723#kev","url":"https://patchfirst.co/cve/CVE-2011-4723/","title":"[KEV] CVE-2011-4723: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability","content_text":"D-Link · DIR-300 Router. In CISA KEV since 2022-09-08. ENISA EUVD lists it as exploited. EPSS 3.1% (higher than 87.6% of CVEs). CVSS 5.7 MEDIUM. ATT&CK: T1078 Valid Accounts; T1552 Unsecured Credentials. Priority 59.5 of 100.","summary":"D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2026-06-16T23:35:18.000Z","tags":["kev","T1078","T1552"],"_patchfirst":{"reason":"kev","priority":59.5,"kev":{"dateAdded":"2022-09-08","ransomware":false},"epss":{"score":0.03064,"percentile":0.87606},"cvss":{"score":5.7,"severity":"MEDIUM","version":"3.1"},"vendor":"D-Link","product":"DIR-300 Router","techniqueIds":["T1078","T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-5902#kev","url":"https://patchfirst.co/cve/CVE-2020-5902/","title":"[KEV] CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1070.004 File Deletion; +1 more. Named in 5 threat reports. Priority 89.9 of 100.","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:22:25.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-30116#kev","url":"https://patchfirst.co/cve/CVE-2021-30116/","title":"[KEV] CVE-2021-30116: Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability","content_text":"Kaseya · Virtual System/Server Administrator (VSA). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.73% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Named in 1 threat report. Priority 83.7 of 100.","summary":"Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-14T05:16:54.000Z","tags":["kev","ransomware","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.85735,"percentile":0.99726},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","techniqueIds":["T1190","T1552"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-9248#kev","url":"https://patchfirst.co/cve/CVE-2017-9248/","title":"[KEV] CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability","content_text":"Progress · ASP.NET AJAX and Sitefinity. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.1% (higher than 99.51% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1552 Unsecured Credentials. Priority 69.8 of 100.","summary":"Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:27:44.000Z","tags":["kev","public-exploit","T1190","T1552"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.75098,"percentile":0.99508},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Progress","product":"ASP.NET AJAX and Sitefinity","techniqueIds":["T1190","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-18988#kev","url":"https://patchfirst.co/cve/CVE-2019-18988/","title":"[KEV] CVE-2019-18988: TeamViewer Desktop Bypass Remote Login Vulnerability","content_text":"TeamViewer · Desktop. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 7.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1552 Unsecured Credentials. Priority 66.3 of 100.","summary":"TeamViewer Desktop Bypass Remote Login Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:25:42.000Z","tags":["kev","public-exploit","T1078","T1552"],"_patchfirst":{"reason":"kev","priority":66.3,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.04707,"percentile":0.91803},"cvss":{"score":7,"severity":"HIGH","version":"3.1"},"vendor":"TeamViewer","product":"Desktop","techniqueIds":["T1078","T1552"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-15105","url":"https://patchfirst.co/cve/CVE-2020-15105/","title":"CVE-2020-15105: In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session","content_text":"Bouke · django-two-factor-auth. Not in CISA KEV. EPSS 0.7% (higher than 53.1% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 14.4 of 100.","summary":"In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session","date_published":"2020-07-10T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1552","T1078"],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00698,"percentile":0.53078},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Bouke","product":"django-two-factor-auth","techniqueIds":["T1552","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15095","url":"https://patchfirst.co/cve/CVE-2020-15095/","title":"CVE-2020-15095: Sensitive information exposure through logs in npm cli","content_text":"npm · cli. Not in CISA KEV. EPSS 0.4% (higher than 34.6% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1552 Unsecured Credentials. Priority 10.0 of 100.","summary":"Sensitive information exposure through logs in npm cli","date_published":"2020-07-07T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1552"],"_patchfirst":{"reason":"published","priority":10,"kev":null,"epss":{"score":0.00404,"percentile":0.34611},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"npm","product":"cli","techniqueIds":["T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-12008","url":"https://patchfirst.co/cve/CVE-2020-12008/","title":"CVE-2020-12008: Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to…","content_text":"Not in CISA KEV. EPSS 0.9% (higher than 61.2% of CVEs). ATT&CK: T1552 Unsecured Credentials. Priority 12.2 of 100.","summary":"Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to…","date_published":"2020-06-29T00:00:00.000Z","date_modified":"2024-08-04T11:48:57.000Z","tags":["T1552"],"_patchfirst":{"reason":"published","priority":12.2,"kev":null,"epss":{"score":0.00948,"percentile":0.61159},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1552"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3763","url":"https://patchfirst.co/cve/CVE-2019-3763/","title":"CVE-2019-3763: The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08…","content_text":"Dell · RSA Identity Governance and Lifecycle. Not in CISA KEV. EPSS 0.3% (higher than 25.5% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 11.3 of 100.","summary":"The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08…","date_published":"2019-09-11T00:00:00.000Z","date_modified":"2024-09-16T22:20:25.000Z","tags":["T1552","T1078"],"_patchfirst":{"reason":"published","priority":11.3,"kev":null,"epss":{"score":0.00324,"percentile":0.25498},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Dell","product":"RSA Identity Governance and Lifecycle","techniqueIds":["T1552","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3787","url":"https://patchfirst.co/cve/CVE-2019-3787/","title":"CVE-2019-3787: UAA defaults email address to an insecure domain","content_text":"Cloud Foundry · UAA Release (OSS). Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). CVSS 8.3 HIGH. ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts; T1098 Account Manipulation. Priority 18.9 of 100.","summary":"UAA defaults email address to an insecure domain","date_published":"2019-06-19T00:00:00.000Z","date_modified":"2024-09-16T21:57:57.000Z","tags":["T1552","T1078","T1098"],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.01102,"percentile":0.65684},"cvss":{"score":8.3,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"UAA Release (OSS)","techniqueIds":["T1552","T1078","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-6549","url":"https://patchfirst.co/cve/CVE-2019-6549/","title":"CVE-2019-6549: An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to…","content_text":"ICS-CERT · PR100088 Modbus gateway. Not in CISA KEV. EPSS 0.6% (higher than 48.3% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 9.7 of 100.","summary":"An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to…","date_published":"2019-02-12T00:00:00.000Z","date_modified":"2024-09-16T22:30:41.000Z","tags":["T1552","T1078"],"_patchfirst":{"reason":"published","priority":9.7,"kev":null,"epss":{"score":0.00592,"percentile":0.48274},"cvss":null,"vendor":"ICS-CERT","product":"PR100088 Modbus gateway","techniqueIds":["T1552","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-15797","url":"https://patchfirst.co/cve/CVE-2018-15797/","title":"CVE-2018-15797: NFS Volume release errand leaks cf admin credentials in logs","content_text":"Cloud Foundry · NFS Volume Release. Not in CISA KEV. EPSS 1.6% (higher than 75.5% of CVEs). CVSS 8.4 HIGH. ATT&CK: T1552 Unsecured Credentials; T1068 Exploitation for Privilege Escalation. Priority 21.0 of 100.","summary":"NFS Volume release errand leaks cf admin credentials in logs","date_published":"2018-12-05T00:00:00.000Z","date_modified":"2024-09-16T18:24:31.000Z","tags":["T1552","T1068"],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.01579,"percentile":0.75466},"cvss":{"score":8.4,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"NFS Volume Release","techniqueIds":["T1552","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-17900","url":"https://patchfirst.co/cve/CVE-2018-17900/","title":"CVE-2018-17900: Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application…","content_text":"Yokogawa · STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500. Not in CISA KEV. EPSS 1.9% (higher than 79.3% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1078 Valid Accounts. Priority 15.9 of 100.","summary":"Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application…","date_published":"2018-10-12T00:00:00.000Z","date_modified":"2024-09-16T19:37:05.000Z","tags":["T1552","T1078"],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.01865,"percentile":0.79256},"cvss":null,"vendor":"Yokogawa","product":"STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500","techniqueIds":["T1552","T1078"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-11088","url":"https://patchfirst.co/cve/CVE-2018-11088/","title":"CVE-2018-11088: Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and…","content_text":"Pivotal · Application Service. Not in CISA KEV. EPSS 1.0% (higher than 61.6% of CVEs). ATT&CK: T1552 Unsecured Credentials; T1068 Exploitation for Privilege Escalation. Priority 12.3 of 100.","summary":"Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and…","date_published":"2018-09-17T00:00:00.000Z","date_modified":"2024-09-17T03:14:36.000Z","tags":["T1552","T1068"],"_patchfirst":{"reason":"published","priority":12.3,"kev":null,"epss":{"score":0.00961,"percentile":0.61579},"cvss":null,"vendor":"Pivotal","product":"Application Service","techniqueIds":["T1552","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}