4983 matches found
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...
CVE-2025-62168
CVE-2025-62168 Squid Proxy Information Disclosure in Error handling Scanner Detection & PoC "Due to a failure to redact HTTP Authentication credentials Squid is vulnerable to an Information Disclosure attack. Severity: This problem allows a script to bypass Browser security protections and learn...
CVE-2026-126837
A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The...
CVE-2026-126837
A validation flaw exists in the DNS SRV host discovery of the MongoDB Node.js driver . When using a mongodb+srv:// connection string, the driver validates hostnames against the connection string's domain but fails to account for specific characters that terminate the hostname early during address...
IBM WebSphere eXtreme Scale 8.6.1.0 < 8.6.2.2 XSS (7293764)
The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.2.2 IBM. It is, therefore, affected by multiple vulnerabilities as referenced in the 7293764 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements fro...
CVE-2026-120012
SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...
CVE-2026-120012 Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...
CVE-2026-120012 Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...
CVE-2026-120012
The SAP Cloud SDK for AI (Node.js) contains an information disclosure vulnerability where certain internal operations may include sensitive authentication credentials in error messages under specific failure conditions. An attacker with low privileges who can access application logs or forwarded ...
CVE-2026-120012
SAP Cloud SDK for AI Node.js could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these...
CVE-2026-71863
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
EUVD-2026-118497
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
CVE-2026-71863 SecureDrop: Onion Service client auth credentials copied to Monitor Server
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...
CVE-2026-71863
The SecureDrop whistleblower submission system (versions 2.13.0 through 2.16.1 ) is vulnerable to sensitive data exposure. When running the securedrop-admin install Ansible playbook with journalist alerts disabled, the system leaves the journalist alert key filename empty. This causes a copy task...
CVE-2026-118763
A flaw was found in @sigstore/oci. This vulnerability allows a malicious or compromised container registry to cause an information disclosure of sensitive authentication credentials. When pushing an artifact, the client sends an upload request to a registry-provided destination address without...
VulnCheck KEV: CVE-2025-62168
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to...
CVE-2026-118174
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...
CVE-2026-114137
A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...
Cleartext Credential Logging
A2A Java SDK is vulnerable to Cleartext Credential Logging. The vulnerability is due to improper error handling in RestHandler.parseRequestBody, where the method logs the full JSON request body at SEVERE level when JsonFormat.parser.merge throws InvalidProtocolBufferException, allowing an attacke...
hMailServer log information leakage vulnerability
Versions 6.0.0 through 6.3.6 of hMailServer contain a vulnerability related to log information leakage. This vulnerability arises because the SMTP server fails to properly hide authentication credentials and writes sensitive information to log files when logging is enabled. As a result, local use...