CVE-2025-57176: Unrestricted Upload of File with Dangerous Type

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption metadata only with file contents...

CVE-2025-50110: Cleartext Transmission of Sensitive Information

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS...

CVE-2025-57176

CVE-2025-57176 affects Siklu EtherHaul EH-8010EH-1200 devices (firmware 7.4.0–10.7.3). The rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location. Uploads use weak encryption (metadata only) with file contents in cleartext and no authentication or path valida...

CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these...

CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these...

User-ID Credential Agent: Cleartext Exposure of Service Account password

An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent Windows-based can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The...

Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these...

Exploit for CVE-2025-50110

CVE-2025-50110 Cleartext Transmission of Sensitive Informa...

UBUNTU-CVE-2025-9086

A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but using clear text HTTP using the same cookie set 3. The same cookie name is set - but with only a slash as path path="/". Since this site is not...

PT-2025-37083

Name of the Vulnerable Software and Affected Versions: Cortex XDR Microsoft 365 Defender Pack affected versions not specified Description: The Cortex XDR Microsoft 365 Defender Pack may allow cleartext exposure of credentials. The severity of this issue is low. Recommendations: At the moment, the...

Linux Distros Unpatched Vulnerability : CVE-2019-14954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. CVE-2019-14954 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2017-8296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kedpm 0.5 and 1.0 creates a history file in /.kedpm/history that is written in cleartext. All of the commands performed in the password manager are written ther...

Linux Distros Unpatched Vulnerability : CVE-2019-9873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server...

EulerOS 2.0 SP10 : ghostscript (EulerOS-SA-2025-2092)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF...

CVE-2025-41708

CVE-2025-41708 involves cleartext transmission due to an insecure default configuration that uses HTTP for the web interface. An unauthenticated attacker on the same network could learn sensitive data during transmission. Connected documents reference affected products (e.g., Bender devices) but ...

CVE-2025-41708 Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41708: Cleartext Transmission of Sensitive Information

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-58401

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account...

Exploit for CVE-2025-58443

CVE-2025-58443 exploit POC for https://github.com/FOGProject/...

Obsidian GitHub Copilot Plugin stores sensitive information in cleartext

Overview Obsidian GitHub Copilot Plugin provided by Pierre-Adrien Vasseur is vulnerable to the following vulnerability. Cleartext storage of sensitive information CWE-312 - CVE-2025-58401 Rui Nakajima reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...