305838 matches found
CVE-2026-101217
Dell Unisphere for PowerMax vApp versions 9.2.4.x are susceptible to a Path Traversal vulnerability (CWE-22). A low privileged attacker with remote access could exploit this flaw to cause Information disclosure . No specific exploit code or in-the-wild exploitation details are provided in the doc...
CVE-2026-109968 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...
CVE-2026-109968
A vulnerability exists in the clevis PKCS#11 pin , where the clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. Because the log file is created without restrictive permissions, it is world-readable under the default process umask, allowing ...
EUVD-2026-101021
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...
CVE-2026-109968
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...
curl: curl: password leak in CURLINFO_EFFECTIVE_URL
A flaw was found in curl. This vulnerability can lead to information disclosure by inadvertently revealing authentication credentials. When curl retrieves credentials from a local configuration file such as a .netrc file, requesting the effective URL metadata can cause the returned destination...
CVE-2026-108072
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...
CVE-2026-108072 Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server...
EUVD-2026-100989
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...
CVE-2026-108071
The TSplus Remote Access software contains an incorrect authentication vulnerability within its multi-factor authentication (MFA) mechanism. A remote attacker who possesses valid first-factor credentials can bypass the second-factor verification because the authentication flow fails to correctly ...
CVE-2026-108071 Improper Multi-Factor Authentication Validation Allows Authentication Bypass
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication MFA mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation...
EUVD-2026-100979
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...
CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...
CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...
CVE-2026-109969
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
CVE-2026-109969
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
EUVD-2026-100954
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
CVE-2026-109969 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...
CVE-2026-109969
A flaw exists in the clevis PKCS#11 pin where the clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, a local user can connect to the control socket to inject arbitrary device...
CVE-2026-109969
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...