CVE-2025-12636 Ubia Ubox

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings...

PT-2025-45388

Name of the Vulnerable Software and Affected Versions Ubia camera ecosystem affected versions not specified Description The Ubia camera ecosystem does not adequately secure API credentials, potentially allowing an attacker to connect to backend services. Successful exploitation could grant an...

EUVD-2020-26138

Malware in sbrugna...

EUVD-2020-4260

Malware in sbrugna...

EUVD-2021-2058

Malware in sbrugna...

EUVD-2020-28155

Malware in sbrugna...

EUVD-2021-25703

Malware in sbrugna...

EUVD-2017-12986

Malware in sbrugna...

EUVD-2014-5143

Malware in sbrugna...

EUVD-2021-22825

Malware in sbrugna...

EUVD-2020-20793

Malware in sbrugna...

EUVD-2016-4724

Malware in sbrugna...

EUVD-2025-20234

Malicious code in bioql PyPI...

OneLogin Bug Let Attackers Use API Keys to Steal OIDC Secrets and Impersonate Apps

A high-severity security flaw has been disclosed in the One Identity OneLogin Identity and Access Management IAM solution that, if successfully exploited, could expose sensitive OpenID Connect OIDC application client secrets under certain circumstances. The vulnerability, tracked as CVE-2025-5936...

CVE-2025-9628 The integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery

The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated attackers to modify critic...

CVE-2025-52492

A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain...

CVE-2023-44384

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

CVE-2021-36786

The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys...

MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'digest/md5' require 'zlib' class MetasploitModule 'MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever', 'Description' = %q MongoDB Ops Manag...

MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever

MongoDB Ops Manager Diagnostics Archive does not redact SAML SSL Pem Key File Password field mms.saml.ssl.PEMKeyFilePassword within app settings. Archives do not include the PEM files themselves. This module extracts that unredacted password and stores the diagnostic archive for additional manual...