Mars: ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration

A publicly accessible directory containing sensitive WordPress configuration files, including database credentials, authentication keys, and API secrets, was discovered. The vulnerability allowed unauthorized access to critical system information through a downloadable zip file. The security team...

PT-2025-12422

Name of the Vulnerable Software and Affected Versions AWS CDK CLI versions prior to 2.178.2 Description The issue arises when the AWS CDK CLI is used with a credential plugin that returns an expiration property with the retrieved AWS credentials, causing the credentials to be printed to the conso...

CVE-2025-26701

An issue was discovered in Percona PMM Server OVA before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3...

VMware Aria Operations Information Disclosure (VMSA-2025-0003)

The version of VMware Aria Operations running on the remote host is missing a vendor supplied patch. It is, therefore, affected by a information disclosure vulnerability that a malicious user with non-administrative privileges could exploit to retrieve credentials for an outbound plugin if a vali...

SUSE CVE-2025-24034

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially...

TP-LINK WR845N 安全漏洞

The TP-LINK WR845N is a wireless router from China P&L TP-LINK. A weak encryption vulnerability exists in the TP-LINK WR845N version V4190219, which originates from transmitting credentials in base64 encoded form, and can be exploited by an attacker to easily decode them via a man-in-the-middle...

PYSEC-2024-310

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

Exploit for CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentia...

PT-2024-10775 · Luvion · Luvion Grand Elite 3 Connect

Name of the Vulnerable Software and Affected Versions: Luvion Grand Elite 3 Connect through 2020-02-25 Description: An issue was discovered that allows clients to authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web...

PT-2024-8211 · Cisco · Cisco Unified Communications Manager Im & Presence Service

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P affected versions not specified Description: A vulnerability in the logging component could allow an authenticated, remote attacker to view sensitive information in...

CVE-2024-9463

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-34542

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process...

CVE-2024-42967

Incorrect access control in TOTOLINK LR350 V9.3.5u.6369B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...

CVE-2024-42966

Incorrect access control in TOTOLINK N350RT V9.3.5u.6139B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. An attacker can gain access to credentials by examining th...

AZL-42928 CVE-2024-6104 affecting package prometheus for versions less than 2.37.0-14

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

PT-2024-27537 · Electrolink · Electrolink Transmitters

Name of the Vulnerable Software and Affected Versions: Electrolink transmitters affected versions not specified Description: The issue concerns Electrolink transmitters storing credentials in clear-text, which could allow an attacker to access the system using these credentials. Recommendations: ...

AVSystem Unified Management Platform Security Vulnerability

AVSystem Unified Management Platform is a comprehensive management platform from AVSystem designed to help enterprises, service providers and carriers manage and monitor their network devices, Internet of Things IoT devices and services. A security vulnerability exists in AVSystem Unified...

Apache Kylin 安全漏洞

Apache Kylin is the United States Apache Apache Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache Kylin suffers from an information disclosu...

CVE-2023-5384

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...