CVE-2025-1738

CVE-2025-1738 - Telecamera Trivision NC227WF PoC 📋 Panoramica In seguito a una divulgazione responsabile, sono state assegnate due CVE ufficiali. CVE| CVSS v3.1| Punteggio| CWE| Tipo ---|---|---|---|--- CVE-2025-1738| AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N| 6.2| CWE-598| Esposizione di password in...

CVE-2019-6693

CVE-2019-6693 Hai cambiato le tue chiavi di crittografia FortiGate predefinite? Esegui questo script e scoprilo! Puoi fornire l'intero dump del file di configurazione o singoli valori crittografati. Se i valori decrittati non sono del tutto senza senso o producono una parola, allora è probabile c...

CVE-2023-46501

CVE-2023-46501 - BoltWire v6.03 - Controllo di accesso improprio Descrizione Nella versione 6.03 del CMS BoltWire , è possibile sfruttare una vulnerabilità di “Controllo degli accessi improprio” tramite il parametro index.php?p=member.admin&action=data, consentendo a un attaccante di visualizzare...

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

xpl-ModernWMS-CVE-2024-57698

Divulgação do Hash MD5 da Senha do Administrador - ModernWMS v1.0 - CVE-2024-57698 Um problema no modernwms v.1.0 permite que um invasor veja o hash MD5 da senha do administrador e outros atributos sem autenticação, mesmo após a configuração inicial e alteração de senha. Isso ocorre devido à...

CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2025-63579

CVE-2025-63579 وصول غير مصرح به إلى جميع أسماء المستخدمين وكلمات المرور المُدخلة في ميزة دفتر العناوين الموجودة في طابعات Kyocera Command Center RX. الوصف الاستخدام غير المصرح به لطابعات Kyocera، يسمح بتصدير جميع المعلومات المخزنة في دفتر عناوين Kyocera. يمكن تجاوز الإجراء الأمني الذي يشفر البيان...

EUVD-2026-66847

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

keysweeper

KEYSWEEPER // SIGINT // SAMY.PL // 전체 공개 // 응용 해킹 KeySweeper KeySweeper는 정상적으로 작동하는 USB 벽면 충전기로 위장한 은밀한 Arduino 기반 장치로, 주변에 있는 모든 Microsoft 무선 키보드의 키 입력을 무선으로 수동 스니핑하고, 복호화하고, 기록한 다음 GSM을 통해 보고합니다. 모든 키 입력은 온라인과 로컬에 기록됩니다. 트리거 단어, 사용자 이름 또는 URL이 입력되면 SMS 알림이 전송되어 비밀번호가 노출됩니다. 전원에서 분리해도 KeySweeper...

CVE-2023-39144

CVE-2023-39144 배경 이 취약점은 2023년 5월에 발견되었습니다. Element55는 법률 사무소가 시간을 추적할 수 있는 소프트웨어를 생산합니다. 이 소프트웨어는 Exchange, SQL, Shoretel과 같은 다양한 위치에서 정보를 가져옵니다. 타임라인 2023년 5월 24일 - Element 55에 취약점 보고 2023년 5월 25일 - Element55가 취약점을 확인하고 버전 22의 일부로 수정하겠다고 밝혔습니다. 그들은 전문적이었고 함께 일하기 좋았습니다 2023년 7월 24일 - Element 55와...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2024-56428

CVE-2024-56428 Credenciais em texto claro no banco de dados local do iLabClient Ler a configuração incluindo a senha O iLabClient é usado para baixar os resultados do servidor de laboratório. Os dados de configuração são armazenados localmente na instância Apache Derby iLabClient. A senha é...

Python-MikrotikLoginExploit

Mikrotik Login Exploit PoC Proof of Concept della vulnerabilità mikrotik CVE-2018-14847 soprattutto su winbox, funziona leggendo la password direttamente da RouterOS sulla porta predefinita 8291. Originale di: https://github.com/BigNerd95/ Requisiti Python 3+ Installazione su Linux root@kitploit:...

EUVD-2026-65219

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76839

Grav before 2.0.16 is affected by an information disclosure vulnerability in its sandboxed Twig templates. The allow-listed offsetGet() and offsetexists() methods lack field filtering on User objects , permitting attackers with page-edit permissions to extract hashed passwords and 2FA secrets , e...

EUVD-2026-64827

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-6017 Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

EUVD-2026-62945

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's documentpassword parameter is not masked an...

CVE-2026-76386

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...