72 matches found
CVE-2018-20555
CVE-2018-20555 El plugin de WordPress llamado Social Network Tabs, creado por la empresa Design Chemical, está filtrando dos veces el accesstoken, accesstokensecret, consumerkey y consumersecret de Twitter de sus usuarios, lo que conduce a una toma de control de su cuenta de Twitter. Esto es...
CVE-2021-40375
CVE-2021-40375 - Control de Acceso Roto en OpenEyes 3.5.1 Descripción Se identificó una vulnerabilidad de control de acceso inadecuado en OpenEyes 3.5.1, desarrollado por la Fundación Apperta. Un usuario con pocos privilegios podría cargar el perfil de un paciente en su navegador y acceder a...
CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...
CVE-2026-7312
creationtimestamp| type| source ---|---|--- 2026-06-02 18:01:35+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnd6h2hiip2w 2026-06-03 02:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mndz7plsio22 2026-06-04 14:37:07+00:00| seen|...
CVE-2026-35383
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete...
Bentley Systems iTwin Platform 安全漏洞
Bentley Systems iTwin Platform is a digital twin cloud platform developed by Bentley Systems. It supports infrastructure data modeling and full-lifecycle management. There is a security vulnerability in Bentley Systems iTwin Platform, which stems from exposed access tokens in the web page source...
CVE-2009-4535
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / slash character to the URI...
CVE-2019-11403
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page...
CVE-2021-47721
Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized...
UBUNTU-CVE-2025-65000
SSH private keys of the "Remote alert handlers Linux" rule were exposed in the rule page's HTML source in Checkmk = 2.4.0p18 and all versions of Checkmk 2.3.0. This potentially allowed unauthorized triggering of predefined alert handlers on hosts where the handler was deployed...
CVE-2025-65000
CVE-2025-65000 affects Checkmk (Linux Remote alert handlers rule). SSH private keys were exposed in the HTML source of the rule page for Checkmk 2.3.0 and all versions up to 2.4.0p18, potentially allowing unauthorized triggering of predefined alert handlers on affected hosts. The Red Hat, NVD, Ub...
EUVD-2017-16773
Malware in sbrugna...
EUVD-2019-3080
Malware in sbrugna...
EUVD-2021-27275
Malware in sbrugna...
EC-WEB FS-EZViewer 信息泄露漏洞
EC-WEB FS-EZViewer is an online document viewing application. An information disclosure vulnerability exists in EC-WEB FS-EZViewer version 10.4.0.X and prior versions, which stems from the presence of a sensitive information disclosure vulnerability. An attacker can obtain database configuration...
BIT-EJBCA-2021-40086
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page that can only be viewed by an administrator. While hidden from direct view, checking the page source would...
CVE-2024-1769 JM Twitter Cards <= 14 - Information Exposure via Meta Description
The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This makes it possible for unauthenticated attackers to view password protected post content when viewing the page source...
CVE-2023-49261
The "tokenKey" value used in user authorization is visible in the HTML source of the login page...
TSplus Security Vulnerabilities
TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus Remote Work version 16.0.0.0, which originates from a plaintext password placed on the var pass of the HTML source code of the secure single sign-on web portal...
