CVE-2021-23182

Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in server memory dumps. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; All versions of 8.30...

CVE-2020-36124

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by XML External Entity XXE injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user clients and administrators...

CVE-2020-3483

Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG...

cxf: OpenId Connect token service does not properly validate the clientId

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...

VulnCheck KEV: CVE-2019-19755

ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

Lychee Live AliCloud OSS credentials have information leakage vulnerability

Lychee Live app is an Internet-based interactive live broadcasting platform launched by Guangdong Network Radio and Television. There is an information leakage vulnerability in Lychee Live Aliyun OSS credentials. The vulnerability is caused by credential leakage due to the use of SDK with...

Amusing phone call AliCloud OSS credentials have information leakage vulnerability

Amusing Phone is a communication APP that combines entertainment and security, developed and launched by Beijing Shusheng Mobile Technology Co. There is an information leakage vulnerability in the AliCloud OSS credentials of Tease Phone. The vulnerability is caused by credential leakage due to th...

Ate little brother ali cloud oss credentials have information leakage vulnerability

The Aite Little Brother app is a service program. There is an information leakage vulnerability in the Aite Little Brother AliCloud oss credentials. The vulnerability stems from the accessKeyId and accessKeySecret, endpoint built into the mobile app, resulting in credential leakage. An attacker c...