CVE-2025-26847

An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked...

CVE-2025-26847

An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked...

CVE-2025-26847

Znuny before 7.1.5 has a vulnerability where, when generating a support bundle, not all passwords are masked. Affects Znuny 7.1.x (older than 7.1.5); root cause is incomplete password masking in the bundle-generation process. Consequence: potential disclosure of passwords via generated support bu...

Znuny 安全漏洞

Znuny is a work order system from Znuny, Inc. A security vulnerability exists in Znuny versions prior to 7.1.5 that stems from passwords not being fully masked, which could lead to information disclosure...

CBL Mariner 2.0 Security Update: shadow-utils (CVE-2023-4641)

The version of shadow-utils installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-4641 advisory. - A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice...

PT-2025-17413 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions prior to 7.4.4 Description: Wing FTP Server does not properly validate and sanitize the url parameter of the /downloadpass.html API endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link,...

CVE-2025-24948

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records...

Important: apache-commons-vfs

Issue Overview: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the...

CVE-2025-24948

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records...

CVE-2025-24948

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records...

JotUrl 安全漏洞

JotUrl is a marketing integration suite from JotUrl, Inc. A security vulnerability exists in JotUrl version 2.0 that stems from a password being sent via an HTTP GET request, which could lead to credential disclosure...

CVE-2025-24948

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records...

PT-2025-16357 · Joturl · Joturl

Name of the Vulnerable Software and Affected Versions: JotUrl version 2.0 Description: The issue involves passwords being sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. Recommendations: For JotUrl version 2.0, consider disabling the use of...

PT-2025-22637

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.05.1 Description The issue lacks argument sanitization for the case in the gs lib ctx stash sanitized arg function in base/gslibctx.c. This allows a created PDF document to include its password in...

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure lies in the exposure of password values in log files, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure is related to the disclosure of password values in log files. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information from ...

Metabase 日志信息泄露漏洞

Metabase is an open source data analytics platform from US-based Metabase, Inc. A log information disclosure vulnerability exists in Metabase that stems from not properly clearing old connection information, leading to username and password disclosure...

event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in EDA

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Azure Linux 3.0 Security Update: pam (CVE-2024-10041)

The version of pam installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10041 advisory. - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger th...

OESA-2025-1357 apache-commons-vfs security update

Commons VFS provides a uniform view of files through a single API which is designed for accessing various different file systems. These file systems could be a local disk, an HTTP server or a ZIP archive file. The key features are listed as follows: The API is consistent among various file types...