Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

CVE-2026-13327

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...

CVE-2026-13327

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...

CVE-2026-13327

Devolutions Server version 2026.2.16 and earlier is vulnerable to a security flaw caused by improper certificate validation on LDAPS connections to Active Directory . A network-positioned attacker can exploit this to intercept privileged directory service credentials by using a spoofed domain con...

EUVD-2026-79189

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...

CVE-2026-13327: Improper Certificate Validation

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate...

PT-2026-92412

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description Improper certificate validation occurs during LDAPS Lightweight Directory Access Protocol over SSL/TLS connections to Active Directory. This allows a network-positioned attacker to...

CVE-2026-87872

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

EUVD-2026-72787

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-33389

An improper certificate/host key validation vulnerability exists in the Smart Polling functionality of Nozomi Networks Guardian/CMC (before 26.3.0 ) and Nozomi Networks Arc (before v2.7.0 ). Encrypted connections to polled devices were established without validating the remote host's identity, an...

PT-2026-87077

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned...

CVE-2026-77847

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

CVE-2026-77847

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior contain a hard-coded credential vulnerability. The flaw allows an attacker on an adjacent network to intercept sensitive information or credentials without requiring prior privileges (CVSS 3.1: 6.5 MEDIUM , CVSS 4.0: 7.1 HIGH ). The device...

EUVD-2026-71752

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials...

Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false...

GHSA-FRJ6-5RHH-VWFW Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the SendPamAuthPacketFactory function. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack or controlling a malicious server that issues an Authentication...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the authentication. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack during the initial handshake. Note: This is only exploitable if SSL/TLS is enabled...