274 matches found
CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session...
CVE-2026-43640
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session...
CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session...
PT-2026-39717
Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.4.1 Description An issue exists where master-password re-authentication is not required when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management...
bitwarden 安全漏洞
Bitwarden is an open-source password management backend service developed by Bitwarden. Versions of Bitwarden prior to 2026.4.1 contained security vulnerabilities. These vulnerabilities stemmed from the lack of a master password re-authentication requirement when retrieving or rotating organizati...
Inadequate Encryption Strength
github.com/cloudflare/gokey is vulnerable to Inadequate Encryption Strength. The vulnerability is due to flawed seed decryption logic that uses only limited entropy from the initialization vector and authentication tag, which allows an attacker with access to the seed file to derive generated...
Password managers keep your passwords safe, unless…
I’m a big advocate of password managers. Granted, there are better alternatives for passwords like passkeys, but if a provider offers nothing but password options, which many do, you can’t do much about that. So, for the time being we seem to be stuck with passwords. Every reputable password...
CVE-2026-25137
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store...
CVE-2026-25137 NixOs Odoo database and filestore publicly accessible with default odoo configuration
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store...
MiracleLinux 7 : firefox-60.2.1-1.0.1.el7.AXS7 (AXSA:2018-3344:06)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3344:06 advisory. Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 Mozilla: Setting a master password post-Firefox 58 does not delete...
GO-2025-4174 gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey
gokey allows secret recovery from a seed file without the master password in github.com/cloudflare/gokey...
CVE-2025-13353
The CVE-2025-13353 issue affects gokey versions prior to 0.2.0, where a flaw in the seed decryption logic caused passwords/secrets derived from a seed file to be generated from only 28 bytes of entropy (instead of using the full seed, 240 bytes). This allowed a malicious actor with just the seed ...
Mozilla Firefox ESR < 60.2.1
The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-23 advisory. - A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored i...
EUVD-2019-3403
Malware in sbrugna...
EUVD-2019-3058
Malware in sbrugna...
EUVD-2003-1599
Malware in sbrugna...
EUVD-2021-16415
Malware in sbrugna...
EUVD-1999-1237
Malware in sbrugna...