278 matches found
enject
enject Hide .env secrets from prAIng eyes. Note: this project was previously called enveil and has been renamed to enject AI coding tools like Claude Code, Copilot, Cursor, and others can read files in your project directory, which means a plaintext .env file is an accidental secret dump waiting ...
CVE-2023-23752-Docker
CVE-2023-23752 Joomla अनधिकृत पहुँच भेद्यता CVE-2023-23752 डॉकरीकृत स्थापना अनुशंसित स्वचालित 1. इस रिपॉजिटरी को क्लोन करें git clone https://github.com/karthikuj/CVE-2023-23752-Docker.git 2. निर्देशिका बदलें cd CVE-2023-23752-Docker 3. चलाएँ ./setup.sh 4. अपना ब्राउज़र खोलें और...
CVE-2026-84381
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...
CVE-2026-84381
A flaw was found in httpcore2, a component used by HTTPX2. When a remote origin uses WebSocket Secure wss through a SOCKS5 proxy, httpcore2 fails to initiate Transport Layer Security TLS encryption because its upgrade condition only recognizes HTTPS. This vulnerability allows an attacker...
CVE-2026-84381 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...
CVE-2026-84381 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...
CVE-2026-77123
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API . An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from API responses. The vu...
CVE-2022-37177
CVE-2022-37177 - HireVue-टूटा-या-जोखिमपूर्ण-क्रिप्टोग्राफिक-एल्गोरिदम जब आप HireVue द्वारा प्रदान किए गए साक्षात्कार आमंत्रण लिंक पर जाते हैं, तो आपको एक शर्त पृष्ठ पर निर्देशित किया जाता है जहाँ आप रिकॉर्डेड और समयबद्ध साक्षात्कार प्रक्रिया शुरू करने से पहले शर्तों से सहमत होते हैं। इस प्रारंभिक...
secure cookie attribute bypass with tab
A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...
Moderate: Red Hat Security Advisory: pam security update
An update for pam is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
RHEL 9 : pam (RHSA-2026:61226)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61226 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...
CVE-2026-81322
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...
EUVD-2026-67089
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
EUVD-2026-67038
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...
CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...
clickhouse-datasource silently drops TLS over PDC
When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...
CVE-2026-75587
Mattermost Desktop App versions
CVE-2026-75587 Plaintext pre-auth secret exposure via Desktop App diagnostics report
Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...
PT-2026-76874
Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions prior to 6.2.2.0 Description The application fails to redact the pre-auth secret during the generation of a diagnostics report. A local attacker with access to the user's log files or diagnostics report can obta...