CVE-2026-41571 Note Mark: OIDC-registered users authenticated by submitting password "null"

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt"null" placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password:...

CVE-2026-41571

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt"null" placeholder whenever a user has no stored password. OIDC-registered users are created with an empty password, so anyone who submits password:...

CVE-2021-41571

creationtimestamp| type| source ---|---|--- 2025-06-04 12:39:24+00:00| seen| https://gist.github.com/Denovo1998/0b2ab59e46ce23a9fa4c61c5d866675f 2025-06-13 11:52:01+00:00| seen| https://gist.github.com/Denovo1998/163e55b3a612873364a00cf0df5a1b95...

CVE-2022-41571

An issue was discovered in EyesOfNetwork EON through 5.3.11. Local file inclusion can occur...

CVE-2022-41571

creationtimestamp| type| source ---|---|--- 2022-09-28 02:36:26+00:00| seen| https://t.me/cibsecurity/50543...

CVE-2022-41571

EyesOfNetwork (EON)

CVE-2022-41571

An issue was discovered in EyesOfNetwork EON through 5.3.11. Local file inclusion can occur...

CVE-2021-41571 Pulsar Admin API allows access to data from other tenants using getMessageById API

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it f...

CVE-2021-41571

CVE-2021-41571 affects Apache Pulsar. The vulnerability arises from improper validation of the ledger id in the Admin API get-message-by-id, allowing a user to read BookKeeper data for tenants other than their own via the topic- and ledger-id context. Affected versions include Pulsar 2.8.0 and ol...

CVE-2021-41571

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it f...