CVE-2021-37842

metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger...

Drupal One Time Password 安全漏洞

Drupal One Time Password is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal One Time Password versions prior to 1.3.0 that stems from a capture replay attack that bypasses authentication and could lead to the theft of...

Drupal Enterprise MFA - TFA for Drupal 安全漏洞

Drupal Enterprise MFA - TFA for Drupal is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Enterprise MFA - TFA for Drupal prior to version 5.2.0, which stems from an authentication bypass that could result in remote...

Arista EOS 安全漏洞

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS that stems from the fact that running gNOI File TransferToRemote RPC with gNMI transfer enabled may result in the disclosure of remote...

Security Advisory 0117

Security Advisory 0117 . CSAF PDF Date: May 6, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 6, 2025 | Initial release 1.1 | May 20, 2025 | Updated affected Arista products Updated mitigation option 3 The CVE-ID tracking this issue: CVE-2025-0936 CVSSv3.1 Base Score: 6.5...

Git Credential Manager 信息泄露漏洞

Git Credential Manager GCM is a secure Git credential assistant open-sourced by Git Ecosystem. An information disclosure vulnerability exists in Git Credential Manager. An attacker could exploit this vulnerability to capture the credentials of another Git remote. The following products and versio...

Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction

!/usr/bin/env python Exploit Title: Tinycontrol LAN Controller v3 LK3 - Remote Credentials Extraction Exploit Author: LiquidWorm Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of...

Tinycontrol LAN Controller 3 Remote Credential Extraction Exploit

!/usr/bin/env python Tinycontrol LAN Controller v3 LK3 Remote Credentials Extraction PoC Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The website presents readin...

Tinycontrol LAN Controller v3 (LK3) Remote Credentials Extraction PoC

Summary Lan Controller is a very universal device that allows you to connect many different sensors and remotely view their readings and remotely control various types of outputs. It is also possible to combine both functions into an automatic if - this with a calendar when - then. The device...

OrangeScrum 跨站脚本漏洞

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. Orangescrum cross-site scripting vulnerability, the vulnerability stems from the application does not properly validate the HTML content to be converted t...

CVE-2023-20038

A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the...

Design/Logic Flaw

A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the...

CVE-2022-41575

A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data e.g., cleartext credentials. This is fixed in 2022.3.3...

DAIKIN SVMPC1 和 SVMPC2 信任管理问题漏洞

DAIKIN SVMPC1 and DAIKIN SVMPC2 are both a single-site and multi-site controller from DAIKIN Japan. A security vulnerability exists in DAIKIN SVMPC1 version 2.1.22 and earlier and SVMPC2 version 1.2.3 and earlier, which originates from a vulnerability that could allow a remote attacker to obtain...

PT-2021-18452 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 versions 11.2 through 11.5 Description: The issue is an information disclosure vulnerability that exposes remote storage credentials to privileged users under specific conditions. Recommendations: For IBM Db2 versions 11.2 through 11....

Security Bulletin: IBM DataPower Gateway can expose remote credentials to local users (CVE-2020-4528)

Summary Passwords provided as part of a URL for an administrative COPY command may appear in the administrative log. If the password is not provided in the URL, it will be prompted for, and will not appear in the log. Vulnerability Details CVEID: CVE-2020-4528 DESCRIPTION: IBM MQ Appliance could...

CVE-2021-27734

Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users...

CVE-2019-16203

Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option when configuring the ESRS client...

BSA-2020-906

Security Advisory ID : BSA-2020-906 Component : authentication Revision : 1.0: Final Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option when configuring the ESRS client. The argumen...

The vulnerability of D-Link DCM-604 and DCM-704 router microprogramming software, related to SNMP request processing errors, allows a hacker to expose account information.

The vulnerability of D-Link DCM-604 and DCM-704 router microprogramming software is related to errors in SNMP requests. Exploiting this vulnerability can allow a remote attacker to obtain login credentials...