Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible. Credentials, such as secrets, are being disclosed in the console logs by default, and are not protected by the nolog feature when those modules are used. An attacker can exploit this information to steal those credentials. The greatest threat posed by this...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in several Ansible modules, where parameters containing credentials, such as “secrets,” were logged in plain text on managed nodes, and were also made visible on the controller node when run in verbose mode. These parameters were not protected by the “nolog” feature. An...

EUVD-2026-77344

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

Vulnerabilities in Microsoft Azure

Microsoft has identified 4 vulnerabilities in various Azure components. A malicious individual could exploit these vulnerabilities to carry out attacks that can lead to various types of damage, as mentioned in the table below. The vulnerability with identifier CVE-2026-69854 has a CVSS score of...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...

CVE-2026-82786

CVE-2026-82786 affects the Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271- *. The root cause is an insufficiently protected credentials issue: if exploited, sensitive information may be restored from a backup file . The vulnerability is scored 6.3 (CVSS v3.1, MEDIUM) and 8.2 (CVSS v4.0,...

cve-2013-4660_PoC

Docker 构建 构建为具有漏洞环境的 Docker 环境。 docker build -f cve-2013-4660 -t cve-2013-4660 . 为了演示攻击成功时服务器内部敏感信息如何泄露，注入虚拟数据库和虚拟数据库密码以及 AWS 密钥后运行容器。 sudo docker run -d --name yaml-lab -e DBPASSWORD="SuperSecretPassword123!" -e AWSACCESSKEYID="AKIAIOSFODNN7EXAMPLE" cve-2013-4660-test 将 PoC.yaml 文件复制到 Docker 容器内...

tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

CVE-2026-31278

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request...

ALSA-2026:67145 Moderate: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in...

ALSA-2026:67147 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-31278

Suprema BioStar 2 (before 2.9.12 ) and BioStar X (before 1.0.2 ) expose Active Directory service account credentials in cleartext via a crafted GET request to the /api/v2/setting/adserversetting endpoint. The vulnerability requires low privileges and has a changed scope , as the leaked credential...

CVE-2026-54628: Improper Access Control

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as jsonreader and logreader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provi...

CVE-2026-57131: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...

CVE-2026-90940: Use of Default Credentials

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

CVE-2026-77883: Exposure of Sensitive Information Through Data Queries

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-75015: Insufficiently Protected Credentials

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...