74225 matches found
ROS-20260911-73-0206
The vulnerability of Digital Credentials components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...
CVE-2026-90451: Use of Default Credentials
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...
CVE-2026-85083: Use of Hard-coded Credentials
The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...
CVE-2026-38058: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...
CVE-2026-81861: Insufficiently Protected Credentials
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...
CVE-2026-90456: Use of Default Credentials
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...
CVE-2026-79396
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...
CVE-2026-79396
The Xiongmai IP Camera XM530 is vulnerable to unauthorized access due to the use of hardcoded default credentials in firmware versions HMT.CM2005-v220608.1837 and earlier. Static account credentials are stored in unencrypted plaintext within the bin/config.xml file and are also compiled into the ...
CVE-2026-79396
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...
PT-2026-90507
Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts, are not restricted from creating, modifying...
PT-2026-90047
Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description The device uses hardcoded default credentials that are stored in unencrypted plaintext within the bin/config.xml file and compiled into the Sofia executable. This...
PT-2026-90516
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A deployment mode designed to provide read-only access to stored data fails to restrict request methods on certain application programming interface routes. This...
PT-2026-89892
Name of the Vulnerable Software and Affected Versions SCADAPack 47x affected versions not specified SCADAPack 47xi affected versions not specified SCADAPack 47xd affected versions not specified SCADAPack 470R affected versions not specified SCADAPack 57x affected versions not specified SCADAPack...
EUVD-2026-76189
Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...
PT-2026-90514
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An API endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store without restricting its...
CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command
NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...
axios: Axios: Information disclosure of proxy credentials via redirect flows
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...
axios: Axios: Information disclosure of proxy credentials via HTTP redirects
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...
