CVE-2016-10512

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-105136.1Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.CVE-2016-105146.5url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URCVE-2016-105156.1In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.CVE-2016-105166.1Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 CVE-2016-105177.4networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valiCVE-2016-105187.5A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a pingCVE-2016-105197.5A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and CVE-2016-10529.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and AcroCVE-2016-105207.5jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.CVE-2016-105217.5jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress vCVE-2016-105228.8rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens andCVE-2016-105237.5MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible wit