CVE-2016-10104

Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for SSH/SFTP profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.

• CWE-326

• http://www.securityfocus.com/bid/96845
• https://rastamouse.me/guff/2016/automize/Third Party Advisory
• http://www.securityfocus.com/bid/96845
• https://rastamouse.me/guff/2016/automize/Third Party Advisory

Published

Jan 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10099Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptog…
• CVE-2016-1010Integer overflow in Adobe Flash Player before 18.0.0.333 and…8.8
• CVE-2016-10100Borg (aka BorgBackup) before 1.0.9 has a flaw in the way dup…
• CVE-2016-10101Information Disclosure can occur in Hitek Software's Automiz…
• CVE-2016-10102hitek.jar in Hitek Software's Automize uses weak encryption …
• CVE-2016-10103Information Disclosure can occur in encryptionProfiles.jsd i…
• CVE-2016-10105admin/plugin.php in Piwigo through 2.8.3 doesn't validate th…
• CVE-2016-10106Directory traversal vulnerability in scgi-bin/platform.cgi o…
• CVE-2016-10107Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-10108Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-10109Use-after-free vulnerability in pcsc-lite before 1.8.20 allo…
• CVE-2016-1011Use-after-free vulnerability in Adobe Flash Player before 18…8.8