CVE-2017-9615

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532 CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cognito.co.nz/mwcommunity/viewtopic.php?f=1&t=3542Vendor Advisory
https://gist.github.com/ari/e0dd74c12d84f102e3bcb365118e8c30Third Party Advisory, Vendor Advisory
http://cognito.co.nz/mwcommunity/viewtopic.php?f=1&t=3542Vendor Advisory
https://gist.github.com/ari/e0dd74c12d84f102e3bcb365118e8c30Third Party Advisory, Vendor Advisory

Timeline

Published: Jun 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-96165.5In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/disse CVE-2017-96175.5In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in epan CVE-2017-96187.8The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (CVE-2017-96197.8The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of CVE-2017-96207.8The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of ser CVE-2017-96216.1Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earli CVE-2017-96226.1Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script CVE-2017-96236.1Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script CVE-2017-96246.1Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script CVE-2017-96258.2An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper au CVE-2017-96269.8Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based ap CVE-2017-96278.6An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and pr