EUVD-2025-206663

A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in the system audit logs. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the Brocade...

CVE-2025-59093 Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker t...

CVE-2024-34715

Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as @ and $, webserver...

EUVD-2004-2708

Malware in sbrugna...

EUVD-2013-4811

Malware in sbrugna...

EUVD-2016-7268

Malware in sbrugna...

EUVD-2018-11706

Malware in sbrugna...

EUVD-2019-6163

Malware in sbrugna...

EUVD-2003-0493

Malware in sbrugna...

EUVD-2003-0013

Malware in sbrugna...

EUVD-2023-42146

Malicious code in bioql PyPI...

GHSA-HC8F-M8G5-8362 File Browser: Command Execution not Limited to Scope

!NOTE This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new...

CVE-2023-34097

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are...

CVE-2004-2718

PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request...

CVE-2024-34715

CVE-2024-34715 affects the Fides webserver, where an improper escaping of the SQLAlchemy password string can cause the database password to be partially exposed in webserver logs when the password contains characters like @ or $. This is due to insufficient escaping of the password in the connect...

PT-2023-24669 · Unknown · Hoppscotch

Name of the Vulnerable Software and Affected Versions: hoppscotch versions prior to 2023.4.5 Description: The issue concerns the exposure of the database password in system logs when the database connection string is displayed. This could allow attackers with access to system logs to elevate thei...

Gigamon GigaVUE-OS database plaintext storage redis password vulnerability

Gigamon GigaVUE-OS is an operating system for GigaVUE network devices from Gigamon, USA. A security vulnerability exists in GigaVUE-OS GVOS versions 5.4 - 5.9, which originates from Redis database passwords stored in clear text. An attacker could use this vulnerability to obtain the database...

Red Hat ovirt-engine Information Disclosure Vulnerability

Red Hat oVirt is an open source virtualization management platform from Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side. overt-engine is one of the control center components, which is capable ...

SQL Injection Vulnerability in EasyAdmin /application/index/controller/index.php Page

EasyAdmin is a free and open source community program based on the LayUI template, with a ThinkPHP5 framework for backend support. SQL injection vulnerability exists in the EasyAdmin /application/index/controller/index.php page. Attackers can construct a specific URL injection to obtain the...

CVE-2015-5959

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log...