195 matches found
EUVD-2026-85707
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...
CVE-2026-81208
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...
CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...
CVE-2026-81208
The IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a critical flaw where the pull endpoint improperly handles encrypted credentials. The system decrypts {dsnextenc}/{encval} blobs using the cluster-wide DSNEXT_SEC_KEY and re-encrypts them under a caller-supplied AES key/IV. Because ...
CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...
CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...
CVE-2026-15316
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the...
CVE-2026-15316
The Tapo C200 v5 configuration service lacks validation on encrypted credential ciphertext length, allowing an attacker on the local network to crash or restart the device by sending oversized values, temporarily disrupting HTTPS management and monitoring. CVSS 7.1 (HIGH), network-adjacent, no au...
The vulnerability in the web-based authentication interface of the Cisco Secure FMC Software allows a perpetrator to escalate their privileges.
The vulnerability in the web-based authentication interface of the Cisco Secure FMC Software for managing network security devices is related to the use of strictly encrypted login credentials. Exploiting this vulnerability can allow a malicious actor to remotely increase their privileges...
EUVD-2026-44738
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes...
PT-2026-52970
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a...
CVE-2026-23395 Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAPECREDCONNREQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending FLAGDEFERSETUP which can cau...
The vulnerability of SolarWinds IT infrastructure management software’s Web Help Desk system, which stems from the use of strictly encrypted user credentials, allows a hacker to escalate their privileges.
The vulnerability of SolarWinds IT infrastructure management software’s Web Help Desk component is related to the use of strictly encrypted user credentials. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...
The vulnerability of the Sitecore Experience Manager (XM) and Experience Platform (XP) content management systems, related to the use of strictly encrypted user credentials, allows attackers to gain access to user accounts with administrative privileges.
The vulnerability of Sitecore Experience Manager XM and Experience Platform XP management systems is related to the use of strictly encrypted user credentials. Exploiting this vulnerability could allow an attacker to gain access to a user account with administrative privileges...
The vulnerability of the software for centralized control of the Ruckus Network Director network infrastructure lies in the use of rigidly encrypted user credentials. This allows a malicious individual to elevate their privileges and gain access to the RND server.
The vulnerability of the software for centralized management of the Ruckus Network Director infrastructure is related to the use of strictly encrypted user credentials. Exploiting this vulnerability can allow an attacker to increase their privileges and gain access to the RND server...
The vulnerability of the software for centralized control of the Ruckus Network Director network infrastructure, which stems from the use of strictly encrypted user credentials, allows a intruder to gain unauthorized access to confidential information.
The vulnerability of the Ruckus Network Director software for centralized control of network infrastructure is related to the use of strictly encrypted user credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential...
The vulnerability of the gRPC authentication application interface of the RustFS distributed data storage system allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to the system.
The vulnerability of the gRPC authentication application interface of the RustFS distributed data storage system is related to the use of strictly encrypted credentials. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms and gain unauthorized access to t...
Missing Authorization
Jenkins is vulnerable to Missing Authorization. The vulnerability is due to a missing permission check on viewing encrypted credential data, which allows attackers with only View/Read permissions to access and view encrypted password values in views...
The vulnerability of FortiWeb web applications’ network firewalls, related to the use of strictly encrypted credentials, allows attackers to gain unauthorized access to protected information.
The vulnerability of FortiWeb web applications’ network firewalls is related to the use of strictly encrypted credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
