2979 matches found
CVE-2024-13995
Nagios XI versions prior to 2024R1.1.2 may confirmed in 2024R1.1 and 2024R1.1.1 disclose sensitive user account information including API keys and hashed passwords to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account...
CVE-2025-62618 ELOG file upload stored XSS
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or...
CVE-2025-62618
ELOG (Electronic Logbook) up to version 3.1.5-20251014 is vulnerable: authenticated users can upload arbitrary HTML files, which are executed in other users’ contexts, exposing usernames and password hashes and enabling credential theft or offline cracking. In the 3.1.5-20251014 release, HTML fil...
CVE-2025-62618 ELOG file upload stored XSS
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or...
CVE-2025-62618 ELOG file upload stored XSS
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or...
EUVD-2024-55056
Nagios XI versions prior to 2024R1.1.2 may confirmed in 2024R1.1 and 2024R1.1.1 disclose sensitive user account information including API keys and hashed passwords to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account...
PT-2025-44664
Name of the Vulnerable Software and Affected Versions ELOG versions prior to 3.1.5-20251014 Description ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. The application includes usernames and...
CVE-2025-54548
On affected platforms, restricted users could view sensitive portions of the config database via a debug API e.g., user password hashes...
CVE-2024-13995
Nagios XI versions prior to 2024R1.1.2 may confirmed in 2024R1.1 and 2024R1.1.1 disclose sensitive user account information including API keys and hashed passwords to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account...
CVE-2024-13995
Nagios XI versions prior to 2024R1.1.2 may confirmed in 2024R1.1 and 2024R1.1.1 disclose sensitive user account information including API keys and hashed passwords to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account...
CVE-2024-13995
CVE-2024-13995 affects Nagios XI versions prior to 2024R1.1.2 (confirmed in 2024R1.1 and 2024R1.1.1). The issue is an authenticated information disclosure where sensitive user data (including API keys and hashed passwords) can be exposed to authenticated users who should not access it. Potential ...
CVE-2024-13995 Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure
Nagios XI versions prior to 2024R1.1.2 may confirmed in 2024R1.1 and 2024R1.1.1 disclose sensitive user account information including API keys and hashed passwords to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account...
EUVD-2025-36725
On affected platforms, restricted users could view sensitive portions of the config database via a debug API e.g., user password hashes...
PT-2025-44498
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.2 Description Nagios XI versions prior to 2024R1.1.2 may disclose sensitive user account information, including API keys and hashed passwords, to authenticated users who should not have access to this data...
CVE-2025-54548
On affected platforms, restricted users could view sensitive portions of the config database via a debug API e.g., user password hashes...
CVE-2025-54548 On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
On affected platforms, restricted users could view sensitive portions of the config database via a debug API e.g., user password hashes...
CVE-2025-54548
CVE-2025-54548 involves a debug API that could let restricted users view parts of the config DB (including password hashes) in Arista DANZ Monitoring Fabric and related DMF/CCF/CVA/MCD deployments. The advisory and Red/NCSC/NVD entries confirm the affected products and the underlying issue, with ...
Arista DANZ Monitoring Fabric 安全漏洞
Arista DANZ Monitoring Fabric is a traffic monitoring, security, and performance analytics platform from Arista USA. A security vulnerability exists in Arista DANZ Monitoring Fabric that originates from a restricted user being able to view sensitive portions of the configuration database via the...
PT-2025-44363
Name of the Vulnerable Software and Affected Versions versions prior to 2025-54548 Description Restricted users could view sensitive portions of the config database via a debug API. Specifically, user password hashes were exposed. The API endpoint used for this exposure is a debug API...
