CVE-2025-47849 Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and...

CVE-2025-48955

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

CVE-2025-48955

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

CVE-2025-48955 Para Server Logs Sensitive Information

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

CVE-2025-48955

Summary: CVE-2025-48955 affects Para Server prior to version 1.50.8, where access and secret keys are logged unredacted during failed configuration logging in HealthUtils.java. This exposes credentials through log files and could enable credential leakage. The issue is resolved in 1.50.8 (upgrade...

CVE-2023-28432

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

CVE-2022-28218

An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys found in a Roundcube configuration file that are used to protect Webmail user passwords and two-factor authentication 2FA...

CVE-2021-25266

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile Android before version 9.7.3495...

CVE-2020-11658

CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization...

MAL-2025-4282 Malicious code in pumptoolforvolumeandcomment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79449c55ca87bbd552651efe9b6e31f77902a2714c4e0fdf0717dcbbb32f7070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4292 Malicious code in @act-platform/app-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3567b231d7c053086778a968fabe2174ddda3fff11c78d9973d2827aaef8d4e8 Any computer that has this package installed or running should be considered...

MAL-2025-3798 Malicious code in node-method-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60414121dfe5a164bd132ab93d581199d55ba6bff4e937c7b52ecf6ca5fa1e0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in just-a-cute-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 762fbe2f0398f3fba03f9f919ed353d349802e39e0942990e4434ec4ddc9c1a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wasitestforeducation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3143ff548280d35ca2611e7959f1e56224da26b7b8a56ce97c67509800fba81a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Anamorphic Cryptography with Elliptic Curve Methods

In 2022, Persianom, Phan and Yung outlined the creation of Anamorphic Cryptography. With this, we can create a public key to encrypt data, and then have two secret keys. These secret keys are used to decrypt the cipher into different messages. So, one secret key is given to the Dictator who must ...

MAL-2025-3062 Malicious code in airbnb-dls-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d026d9563a73efac2558b2cf71cd6696600aecb85004606ba3dd3a87100bad0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2731 Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Output Neutralization for Logs

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to the incomplete masking of API keys in the logging functionality. An attacker can expose sensitive information by accessing th...

unsanitised Input in code node

Description We can run sandboxed code node with full permissions, before the the sandbox security restrictions are imposed. Javascript allows overriding global functions, thus by defining the parseInt function inside a javascript code node, we are able to execute code with full root permissions o...

CVE-2025-29780 Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the...