CVE-2020-29550

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/000000010000000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.

• CWE-312

• http://packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/49Exploit, Mailing List, Third Party Advisory
• https://urve.co.uk/system-rezerwacji-salVendor Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-042.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/49Exploit, Mailing List, Third Party Advisory
• https://urve.co.uk/system-rezerwacji-salVendor Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-042.txtExploit, Third Party Advisory

Published

Dec 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-29539A Cross-Site Scripting (XSS) issue in WebUI Translation in S…5.4
• CVE-2020-2954Vulnerability in the PeopleSoft Enterprise HRMS product of O…6.1
• CVE-2020-29540API calls in the Translation API feature in Systran Pure Neu…7.5
• CVE-2020-29547An issue was discovered in Citadel through webcit-926. Meddl…5.9
• CVE-2020-29548An issue was discovered in SmarterTools SmarterMail through …8.1
• CVE-2020-2955Vulnerability in the Oracle FLEXCUBE Core Banking product of…6.3
• CVE-2020-29551An issue was discovered in URVE Build 24.03.2020. Using the …9.1
• CVE-2020-29552An issue was discovered in URVE Build 24.03.2020. By using t…9.8
• CVE-2020-29553The Scheduler in Grav CMS through 1.7.0-rc.17 allows an atta…8.8
• CVE-2020-29555The BackupDelete functionality in Grav CMS through 1.7.0-rc.…8.1
• CVE-2020-29556The Backup functionality in Grav CMS through 1.7.0-rc.17 all…5.5
• CVE-2020-29557An issue was discovered on D-Link DIR-825 R1 devices through…9.8