wrongsecrets

OWASP WrongSecrets 欢迎来到 OWASP WrongSecrets 游戏！本游戏汇集了现实生活中关于如何 不 在软件中存储密钥的真实案例。每个案例都被设计成一个挑战，你需要使用各种工具和技术来解决它。解决这些挑战将帮助你识别常见错误，并有助于你反思自己的密钥管理策略。 你能解决全部 72 个挑战吗？ 可以在我们的 Heroku 演示环境中尝试其中一些挑战。 想玩其他挑战？请阅读下方关于如何设置它们的说明。 🚀 快速开始 初次接触 WrongSecrets？从这里开始： 1. 先在线尝试 ：访问我们的 Heroku 演示，熟悉这些挑战 2. 本地运行 ：使用 Docker...

@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55100 via hashi-vault-js (>=0.4.11, <=0.4.16)

hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55100 Source advisory: OSV:GHSA-G956-2F74-RMV7...

GHSA-C4P6-QG4M-9JMR KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Impact An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account...

Contrast leaks workload secrets to logs on INFO level

This is the same vulnerability as https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8. The original vulnerability had been fixed for release v1.8.1, but the fix was not ported to the main branch and thus not present in releases v1.9.0 ff. Below is a brief repetition of...

CVE-2024-45744

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a...

CVE-2024-45744

TopQuadrant TopBraid EDG stores external credentials in edg-vault.properties and reads secrets from edg-setup.properties, enabling an authenticated attacker with file-system access to decrypt external passwords. Affected from at least v7.1.3; attacker access may be gained via another vulnerabilit...

CVE-2024-45744 TopQuadrant TopBraid EDG password manager stores external credentials insecurely

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a...

CVE-2024-45744 TopQuadrant TopBraid EDG password manager stores external credentials insecurely

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a...

TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities

RISK EVALUATION TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs. 2. RECOMMENDED PRACTICES Upgrade to TopQuadrant TopBraid...