66 matches found
CVE-2026-12266
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API...
CVE-2026-12266 Authenticated Broken Access Control
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API...
CVE-2026-12266
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure . This issue arises from an insufficiently protected LDAP settings API , which can lead to the exposure of sensitive credentials. The vulnerability is associated with CWE-862 (Missing A...
EUVD-2026-120892
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API...
PT-2026-141595
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API...
CVE-2026-12266: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through…
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API...
CVE-2026-108795
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
EUVD-2026-97166
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
CVE-2026-108795
A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the System Settings API component. Specifically, an unknown functionality in the file /base/api/systemSettings suffers from improper access controls (CWE-284, CWE-266). An attacker can initiate this attack remotely to manip...
CVE-2026-108795: Improper Access Control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
PT-2026-110435
Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description Improper access controls exist within the System Settings API component. A remote attacker can exploit this by manipulating the '/base/api/systemSettings' endpoint to gain unauthoriz...
EUVD-2026-92051
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129: Incorrect Authorization
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129
LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...
CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...