CVE-2025-43005 Information Disclosure vulnerability in SAP GUI for Windows

SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. While this issue does not impact the Integrity or Availability of the application, it may have a Low impact on the Confidentiality of data...

CVE-2025-43005

CVE-2025-43005 affects SAP GUI for Windows via insecure obfuscation in GuiXT for storing credentials. This can lead to information disclosure with Low confidentiality impact. The issue is exploitable by an unauthenticated attacker and is classified with a Local attack vector and No privileges req...

CVE-2025-31329 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

CVE-2025-31329

Summary: CVE-2025-31329 affects SAP NetWeaver (ABAP/ABAP Platform) with an information-disclosure via malicious instructions injected into user configuration settings. An administrator can craft instructions that, when loaded by the victim, exposes credentials and enables unauthorized access to l...

CVE-2025-31329: Improper Neutralization of Parameter/Argument Delimiters

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

Huawei EulerOS: Security Advisory for wget (EulerOS-SA-2025-1545)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-47730

The TeleMessage archiving backend through 2025-05-05 accepts API calls to request an authentication token from the TM SGNL aka Archive Signal app with the credentials of logfile for the user and enRR8UVVywXYbFkqUQDPRkO for the password...

CVE-2025-20214

A vulnerability in the Network Configuration Access Control Module NACM of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists because a subtle change in inner API call behavior caus...

DRUPAL-CONTRIB-2025-056

The module enables you to add second-factor authentication in addition to the default Drupal login. The module does not sufficiently ensure that known login routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password...

CVE-2025-46340 Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in UrlPreviewService and MkUrlPreview, it is possible for an attacker to inject arbitrary CSS into the MkUrlPreview component...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has fixed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-39077 DESCRIPTION: IBM Security Guardium stores user credentials in plain clear text which can be read by a local privileged user. CVSS Base score: 4.4 CVSS Temporal Score: See:...

CVE-2025-46617

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and...

BEC Routers 安全漏洞

BEC Routers is a series of routers from BEC USA. A security vulnerability exists in BEC Routers that originates in the /cgi-bin/toolsusermanage.asp transfer of a list of user credentials, which could lead to the disclosure of sensitive information...

USN-7444-1: Synapse vulnerabilities

It was discovered that Synapse network policies could be bypassed via specially crafted URLs. An attacker could possibly use this issue to bypass authentication mechanisms. CVE-2023-32683 It was discovered that Synapse exposed cached device information. An attacker could possibly use this issue t...

CVE-2025-3578

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

CVE-2025-3578

A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the...

Security Bulletin: Security vulnerabilities have been discovered in IBM Security Verify Bridge (CVE-2024-45673, CVE-2024-45674)

Summary Security vulnerabilities have been addressed in IBM Security Verify Bridge offering. Vulnerability Details CVEID:CVE-2024-45673 DESCRIPTION: IBM Security Verify Bridge stores user credentials in configuration files which can be read by a local user. CWE:CWE-260: Password in Configuration...

CVE-2025-24375

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

EulerOS 2.0 SP11 : wget (EulerOS-SA-2025-1381)

According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...