67 matches found
CVE-2018-20555
CVE-2018-20555 由 Design Chemical 公司开发的 WordPress 插件 Social Network Tabs 两次泄露了其用户的 Twitter accesstoken、accesstokensecret、consumerkey 和 consumersecret，导致其 Twitter 账户被接管。 问题出在显示 Twitter 微件的页面中的以下代码行： root@kitploit: jQuerydocument.readyfunction $ var config = widgets: "twitter,facebook,youtube",...
CVE-2021-40375
CVE-2021-40375 - OpenEyes 3.5.1 中的失效的访问控制 描述 在由 Apperta Foundation 开发的 OpenEyes 3.5.1 中发现了一个不当的访问控制漏洞。 低权限用户可以在其浏览器中加载患者档案，并在未具备所需权限级别的情况下访问敏感信息。尽管应用程序在网页上返回了“Forbidden”（禁止访问）消息，但服务器响应仍返回了关于该患者的全部信息。这些信息可以通过拦截代理查看，或者直接在浏览器中查看页面源代码来获取。 复现步骤 1. 以高权限用户身份查看患者档案。 2. 复制该患者档案的 URL。 3. 退出 OpenEyes 会话。 4...
CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...
CVE-2026-7312
creationtimestamp| type| source ---|---|--- 2026-06-02 18:01:35+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnd6h2hiip2w 2026-06-03 02:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mndz7plsio22 2026-06-04 14:37:07+00:00| seen|...
CVE-2026-35383
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete...
Bentley Systems iTwin Platform 安全漏洞
Bentley Systems iTwin Platform is a digital twin cloud platform developed by Bentley Systems. It supports infrastructure data modeling and full-lifecycle management. There is a security vulnerability in Bentley Systems iTwin Platform, which stems from exposed access tokens in the web page source...
CVE-2009-4535
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / slash character to the URI...
CVE-2019-11403
In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page...
CVE-2021-47721
Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized...
UBUNTU-CVE-2025-65000
SSH private keys of the "Remote alert handlers Linux" rule were exposed in the rule page's HTML source in Checkmk = 2.4.0p18 and all versions of Checkmk 2.3.0. This potentially allowed unauthorized triggering of predefined alert handlers on hosts where the handler was deployed...
CVE-2025-65000
CVE-2025-65000 affects Checkmk (Linux Remote alert handlers rule). SSH private keys were exposed in the HTML source of the rule page for Checkmk 2.3.0 and all versions up to 2.4.0p18, potentially allowing unauthorized triggering of predefined alert handlers on affected hosts. The Red Hat, NVD, Ub...
EUVD-2019-3080
Malware in sbrugna...
EUVD-2017-16773
Malware in sbrugna...
EUVD-2021-27275
Malware in sbrugna...
EC-WEB FS-EZViewer 信息泄露漏洞
EC-WEB FS-EZViewer is an online document viewing application. An information disclosure vulnerability exists in EC-WEB FS-EZViewer version 10.4.0.X and prior versions, which stems from the presence of a sensitive information disclosure vulnerability. An attacker can obtain database configuration...
BIT-EJBCA-2021-40086
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page that can only be viewed by an administrator. While hidden from direct view, checking the page source would...
CVE-2024-1769 JM Twitter Cards <= 14 - Information Exposure via Meta Description
The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This makes it possible for unauthenticated attackers to view password protected post content when viewing the page source...
CVE-2023-49261
The "tokenKey" value used in user authorization is visible in the HTML source of the login page...
TSplus Security Vulnerabilities
TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus Remote Work version 16.0.0.0, which originates from a plaintext password placed on the var pass of the HTML source code of the secure single sign-on web portal...
