FlowiseAI Exposes Basic Auth Credentials via API

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Severity | Medium | | CWE | CWE-522 Insufficiently Protected Credentials | | Location | packages/server/src/enterprise/controllers/account.controller.ts:128-135 | | Practical Exploitability | Medium | | Developer Approv...

Cleartext Storage Of Sensitive Information

wwbn/avideo is vulnerable to Cleartext Storage of Sensitive Information. The vulnerability is due to storing video passwords in plaintext without encryption or hashing, which allows an attacker with database access to retrieve all passwords in cleartext...

AVideo has Plaintext Video Password Storage

Summary AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database via SQL injection, a database backup, or misconfigured access...

GHSA-363V-5RH8-23WG AVideo has Plaintext Video Password Storage

Summary AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database via SQL injection, a database backup, or misconfigured access...

The vulnerability in the implementation of the interaction protocol between the “ARM Reliezer” software and the “Server Communication” software of the EKRASMS-SP software suite allows a perpetrator to recover the password.

The vulnerability of the implementation of the interaction protocol between the “ARM Reliezer” software and the “Server Communication” software of the EKRASMS-SP suite lies in the absence of a hashing mechanism, as well as the presence of pre-set authentication data used for encrypting passwords...