CVE-2026-36851

CVE-2026-36851 UnPoller v2.33.0의 file:// 비밀번호 접두사를 통한 경로 탐색 / 임의 파일 읽기 취약점. 인증 과정에서 파일 내용이 디스크에서 읽혀 구성된 UniFi 컨트롤러 URL로 전송됩니다. | ---|--- CVE| CVE-2026-36851 제품| UnPoller v2.33.0 이전 버전도 영향을 받을 가능성 있음 취약점| CWE-22 경로 탐색, CWE-20 잘못된 입력 검증 CVSS 3.1| 7.5 높음 — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 신고자|...

CVE-2026-1814 Rapid7 Nexpose Insecure Java Keystore Password Generation

Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword method. When updating legacy keystore passwords, the application generates a new password with insufficient length 7-12 characters and a static prefix...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

CVE-2025-57434

The Creacast Creabox Manager device management system contains a critical authentication flaw that allows for a login validation bypass. An attacker can gain unauthorized access by using the username creabox and a password starting with the prefix creacast, regardless of any subsequent characters...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

TYPO3 12.0.0 < 12.4.37 / 13.0.0 < 13.4.18 (TYPO3-CORE-SA-2025-019)

The version of TYPO3 installed on the remote host is 12.0.0 prior to 12.4.37 / 13.0.0 prior to 13.4.18. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2025-019 advisory. - By default, the Password Generation component creates a password that always begins with a...

crypt(): DES encrypted password weakness

The cryptdes aka DES-based crypt function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an...