Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

Summary In Central Browser mode, the /api/4/serverslist endpoint returns raw server objects from GlancesServersList.getserverslist. Those objects are mutated in-place during background polling and can contain a uri field with embedded HTTP Basic credentials for downstream Glances servers, using t...

PT-2026-25820

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.2 Description Glances, an open-source system cross-platform monitoring tool, contains a critical issue in its Central Browser mode. The /api/4/serverslist endpoint returns raw server objects that can contain...

CVE-2025-42890

SQL Anywhere Monitor Non-GUI baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system...

EUVD-2025-27986

Malicious code in bioql PyPI...

CVE-2025-58269 WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability

Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through = 2.6.25...

SUSE CVE-2014-6274

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in effectively plaintext, not encrypted as they were supposed to be. This issue affects...

DEBIAN-CVE-2014-6274

git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in effectively plaintext, not encrypted as they were supposed to be. This issue affects...

SICK Field Analytics和SICK Media Server 安全漏洞

SICK Field Analytics and SICK Media Server are both products of the German company SICK.SICK Field Analytics is software for evaluating manufacturing data.SICK Media Server is a media server. A security vulnerability exists in SICK Field Analytics and SICK Media Server that stems from the inclusi...

CVE-2025-41380

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string...

CVE-2025-41380 Injection vulnerability in Iridium Certus 700

Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string...

Intellian Iridium Certus 700 信任管理问题漏洞

Intellian Iridium Certus 700 is a marine satellite Internet system from Intellian Corporation in South Korea. A trust management issue vulnerability exists in Intellian Iridium Certus 700 version 1.0.1, which stems from an embedded credentials vulnerability that could lead to the retrieval of SSH...

PT-2025-22718 · Iridium · Iridium Certus 700

Name of the Vulnerable Software and Affected Versions: Iridium Certus 700 version 1.0.1 Description: The issue is related to an embedded credentials vulnerability in the code, allowing a local user to retrieve the SSH hash string. Recommendations: For Iridium Certus 700 version 1.0.1, consider...

CISA Releases Guidance on Credential Risks Associated with Potential Legacy Oracle Cloud Compromise

CISA is aware of public reporting regarding potential unauthorized access to a legacy Oracle cloud environment. While the scope and impact remains unconfirmed, the nature of the reported activity presents potential risk to organizations and individuals, particularly where credential material may ...

SUSE CVE-2024-10524

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host...

PT-2024-6867 · D Link · D-Link Wireless Routers

Name of the Vulnerable Software and Affected Versions: D-Link wireless routers affected versions not specified Description: The issue is related to the telnet service in certain D-Link wireless routers, where user input is not properly validated, allowing unauthenticated remote attackers to use...

PT-2023-10181

Name of the Vulnerable Software and Affected Versions git-annex versions affected versions not specified Description The issue concerns the storage of embedded credentials on encrypted remotes in git-annex. When embedcreds=yes is set and the remote uses encryption=pubkey or encryption=hybrid, the...

CVE-2021-43978

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials...

PT-2021-23989

Name of the Vulnerable Software and Affected Versions: Allegro Windows version 3.3.4152.0 Description: The issue allows users to access and modify data using the same credentials as the software administrator because the credentials are embedded into the binary files of Allegro Windows...

CVE-2020-29001

An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a...

Geeni Multiple Product Security Vulnerabilities

Geeni GNC-CW028 and so on are products of Geeni USA.Geeni GNC-CW028 is an indoor webcam.Geeni GNC-CW025 is an indoor webcam.Merkury MI-CW024 and so on are products of Merkury USA.Merkury MI-CW024 is an indoor webcam.Merkury MI-CW017 is an indoor webcam. Geeni A security vulnerability exists in...