31 matches found
CVE-2026-110805
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...
CVE-2026-110805
A Server-side request forgery (SSRF) vulnerability exists in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier . This flaw allows an authenticated low-privileged user to exfiltrate stored PingOne application secrets by providing an attacker-controlled PingOne confi...
EUVD-2026-102877
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...
PT-2026-115608
Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.8.1 Description An authenticated low-privileged user can perform a Server-side request forgery SSRF via the PingOne groups endpoint. This occurs when an attacker-controlled PingOne configuration is...
CVE-2026-3367
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The registersetting call on line 197 lacks a sanitiz...
PT-2026-53458
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...
EUVD-2024-52815
Malicious code in bioql PyPI...
EUVD-2021-29073
Malicious code in bioql PyPI...
PT-2025-37401
Name of the Vulnerable Software and Affected Versions One Identity OneLogin versions prior to 2025.3.0 Description A security issue exists in One Identity OneLogin that allows attackers to potentially steal sensitive OpenID Connect OIDC application client secrets. This is possible through a reque...
PT-2025-18266 · Ctrlx Os · Ctrlx Os
Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Backup & Restore” functionality of the web application allows a remote authenticated low-privileged attacker to access secret information via multiple crafted HTTP...
WordPress plugin Flexmls IDX Plugin: Cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
CVE-2024-55578
The ticket management software Zammad (versions prior to 6.4.1 ) is vulnerable to the insertion of sensitive information into log files (CWE-532 ). The root cause is the inclusion of secrets such as auth_microsoft_office365_credentials and application_secret within the logs. This exposure could l...
PT-2024-36559
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 6.4.1 Description The issue concerns the exposure of sensitive data in log files. Sensitive data, such as auth microsoft office365 credentials and application secret, is placed in log files. This affects Zammad version...
CVE-2024-55578
Zammad before 6.4.1 places sensitive data such as authmicrosoftoffice365credentials and applicationsecret in log files...
Incorrect Authorization
openstack-keystone is vulnerable to Incorrect Authorization. The vulnerability is caused due to a flaw where only the first 72 characters of an application secret are verified. This allows attackers to bypass some password complexity which administrators may be counting on leading to compromising...
SUSE CVE-2021-3563
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity...
CVE-2021-3563
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity...
CVE-2021-42087
An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...
