An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this…

Description

An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within the browser until a decision is made. The code of the pop-up window can be read by remote servers and contains the login credentials and URL in cleartext. A malicious server could easily grab this information from the pop-up. This is related to id="uniqkey-password-popup" and password-popup/popup.html.

Scores

EPSS (exploitation in 30 days)

2.7% · top 14% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• n/a
• CWE-269 (opens in a new tab)All about CWE-269 and its CVEs

Affected products

• n/a

  • affected n/a

References (4)

• https://seclists.org/fulldisclosure/2019/Apr/1 (opens in a new tab)x_refsource_MISCx_transferred
• https://packetstormsecurity.com/files/152410/Uniqkey-Password-Manager-1.14-Credential-Disclosure.html (opens in a new tab)x_refsource_MISCx_transferred
• https://cxsecurity.com/issue/WLB-2019040055 (opens in a new tab)x_refsource_MISCx_transferred
• https://vuldb.com/?id.132740 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-10676](https://trackcve.app/badge/CVE-2019-10676.svg)](https://trackcve.app/cve/CVE-2019-10676)

Record last updated 4 Aug 2024, 22:32 UTC.