75195 matches found
CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...
Number Sea Wen Zhou Visual Drag-and-Drop Big Data Integration Platform Backend Authorization Vulnerability
The Noshai Wenzhou Visual Drag-and-Drop Big Data Integration Platform has an authorization issue in its backend. This vulnerability stems from insecure direct object references. Members of the workspace who are authenticated can access data sources in other workspaces by sending an external...
Number Sea Wen Zhou Visual Drag-and-Drop Big Data Integration Platform Backend Encryption Vulnerability
The backend commit efeacd3 and previous versions of the visual drag-and-drop big data integration platform have vulnerabilities related to encryption. This vulnerability stems from the use of a hardcoded public default AES key in the AesPasswordEncAndDecServiceImpl component. This allows...
izhaorui Zr.Admin.NET SQL Injection Vulnerability
Zr.Admin.NET versions 3.8.2 and earlier have a SQL injection vulnerability. This vulnerability stems from the use of the GET /system/user/list endpoint to pass a specially crafted PagerInfo.Sort query parameter to the shared ToPage pagination helper function. Attackers can exploit this...
Guangzhou Juan IoT EseeCloud App Trust Management Vulnerability
The Guangzhou Juan IoT EseeCloud App versions 4.9.6 and earlier, as well as the EseeCloud Firmware version 4.9.86.0 and earlier, have a trust management vulnerability. This vulnerability stems from the use of hard-coded credentials, which may allow attackers to log into EseeCloud devices...
Databufflabs Databuff Trust Management Vulnerabilities
Databufflabs Databuff versions 0.1.10 and earlier have a trust management issue. This vulnerability stems from the presence of hardcoded default credentials, allowing unauthenticated attackers to use the built-in admin/Databuff@123 account to obtain administrator privileges. They can then access...
Astra Linux – Vulnerability in docker.io
Docker CLI is the command-line interface for the Docker container runtime. A bug was discovered in Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json, which lists a credsStore or credhelpers that cannot be...
Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue 1 It was reported that the acct2 system call can be used to trigger a NULL dereference in cases where it is set to write to a file that triggers an internal lookup. This can, for example,...
Astra Linux – vulnerability in net-snmp
Net-SNMP provides various tools related to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials could exploit an improper input validation vulnerability by setting malformed OIDs in both the master agent and subagent simultaneously. Version 5.9.2...
Astra Linux – Vulnerability in Lynx
Lynx versions up to 2.8.9 mishandled the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials, as these credentials might appear in SNI data...
Astra Linux – Vulnerability in net-snmp
Net-SNMP provides various tools related to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the INDEX in NET-SNMP-VACM-MIB could lead to an out-of-bounds memory access. A user with read-only credentials could exploit this issue. Version 5.9.2...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: smb: client: Do not log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...
Astra Linux – vulnerability in curl
Curl versions 7.1.1 through 7.75.0 are vulnerable to an “Exposure of Private Personal Information to an Unauthorized Actor” issue, as it leaks credentials via the HTTP Referer: header. libcurl fails to remove user credentials from URLs when automatically populating the Referer: HTTP request heade...
CVE-2026-103509
P4 Search formerly Helix Search returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3...
EUVD-2026-102095
P4 Search formerly Helix Search returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3...
CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
UBUNTU-CVE-2026-110924
Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...
SUSE CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...
