CVE-2021-22657: Improper Neutralization of Special Elements used in an OS Command

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter...

CVE-2021-39342

The CredovaFinancial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8...

U.S. Dept Of Defense: Git repo on https://██████.mil/ discloses API password

Summary: I found a .git repository on https://███████.mil/.git which discloses an API password for Yubikey on 2 different domains, together with full source code. Description: Fetching the git repository and decompressing the objects results in the ability to read the source code of the server,...