CVE-2021-36786

The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...

Command injection

The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...

CVE-2021-36786

The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...

CVE-2021-36786

CVE-2021-36786 concerns the miniorange_saml (Miniorange Saml) extension for TYPO3, prior to version 1.4.3. The issue is an information disclosure vulnerability that allows exposure of API credentials and private keys due to inadequate handling/encoding, as described in multiple connected sources ...

Multiple vulnerabilities in Extension "Miniorange Saml" (miniorange_saml)

The extension fails to properly encode user input for output in HTML context CVE-2021-36785. Also the extension contains sensitive data API credentials and private key which should not have been published CVE-2021-36786. Finally the extension bundles several 3rd Party Components jQuery and...

CVE-2020-11923

An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged...

Design/Logic Flaw

An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged...

CVE-2020-11923

Product/Version affected: WiZ Colors A60 1.14.0. Vulnerability: API credentials are logged locally, which can expose sensitive information. Root cause (as stated): Credentials end up in local logs. Impact (as stated): Potential exposure of API credentials due to local logging (no details on explo...

CVE-2020-11923

An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged...

Wordpress ActiveCampaign Cross-Site Request Forgery Vulnerability

Wordpress ActiveCampaign is Wordpress open source an application plugin . The WordPress ActiveCampaign plugin, versions before 8.0.2 suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF checks, which can be exploited by an attacker to exploit an account's API...

CVE-2021-24133

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

Cross site request forgery (csrf)

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

CVE-2021-24133 ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

CVE-2021-24133

The CVE-2021-24133 entry concerns the WordPress ActiveCampaign plugin prior to version 8.0.2, where a lack of CSRF checks on the Settings form could allow a logged-in administrator to change API credentials to the attacker’s account. Affected component: ActiveCampaign WordPress plugin (settings h...

IBM Spectrum Scale Unauthorized Access Vulnerability

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

Elastic: Over-Privileged API Credentials for Elastic Agent

@captaingeech found that the permissions grated to the Elastic Agent in a Fleet environment grant the ability to delete documents from sensitive security indices...

Barco wePresent WiPG-1600W Hardcoded API Credentials Vulnerability

Barco wePresent device firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Versions affected include 2.5.1.8, 2.5.0.25, 2.5.0.24, and...

Barco wePresent WiPG-1600W Trust Management Issue Vulnerability

The Barco Barco wePresent WiPG-1600W is a management device for use in conference environments from Barco Belgium. A security vulnerability exists in the Barco wePresent WiPG-1600W that stems from the inclusion of a hard-coded API account and password that can be discovered by examining the...

Barco wePresent Hardcoded API Credentials

Vulnerability Details Affected Vendor: Barco Affected Product: wePresent WiPG-1600W Affected Version: 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19 Platform: Embedded Linux CWE Classification: CWE-798: Use of Hard-coded Credentials CVE ID: CVE-2020-28329 2. Vulnerability Description Barco wePresent...

CVE-2020-7018

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same...