77595 matches found
CVE-2026-34472
The ZTE ZXHN H188A routers, specifically versions V6.0.10P2_TE and V6.0.10P3N3_TE , are vulnerable to unauthenticated credential disclosure via the pre-login wizard interface. The root cause is that the router_logic_impl.lua script accepts untrusted _type and _tag values for empty-path requests, ...
CVE-2026-34472
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2TE and V6.0.10P3N3TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK,...
PT-2026-29009
Name of the Vulnerable Software and Affected Versions Navicat for Oracle version 12.1.15 Description Navicat for Oracle version 12.1.15 contains a denial of service issue that allows local attackers to crash the application. This occurs by providing an excessively long string in the password fiel...
PT-2026-29007
Name of the Vulnerable Software and Affected Versions ArthurFiorette steam-trader version 2.1.1 Description A sensitive information exposure issue exists. An unauthenticated attacker can send a request to the /users API endpoint to retrieve sensitive Steam account data, including the account...
PT-2026-46560
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in the Password Manager allows a remote attacker to perform UI spoofing via malicious network traffic. UI spoofing is a technique where an...
Navicat 安全漏洞
Navicat is a database management tool developed by Navicat Corporation. It aims to provide a visual user interface, making it easier for users to manage the design, development, and maintenance of databases. Version 12.1.15 of Navicat has a security vulnerability; this vulnerability stems from a...
CVE-2019-25653: Unverified Password Change
Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the password field. Attackers can paste a buffer of 550 repeated characters into the password parameter during Oracle connection...
CVE-2026-33373
Zimbra Collaboration (ZCS) versions 10.0 and 10.1 are vulnerable to a Cross-Site Request Forgery (CSRF) issue in the Zimbra Web Client. The root cause is the issuance of authentication tokens that lack CSRF protection during specific account state transitions, such as after enabling two-factor au...
CVE-2026-34472
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2TE and V6.0.10P3N3TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK,...
PT-2026-28306
Name of the Vulnerable Software and Affected Versions CENTUM versions R5.01.00 through R5.04.20 CENTUM versions R6.01.00 through R6.12.00 CENTUM version R7.01.00 Description The affected software contains a hardcoded password for the PROG user account, used for CENTUM Authentication Mode. An...
PT-2026-29045
Name of the Vulnerable Software and Affected Versions ZTE ZXHN H188A versions V6.0.10P2 TE through V6.0.10P3N3 TE Description An issue exists that allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface. These credentials...
CVE-2026-34472
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2TE and V6.0.10P3N3TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK,...
Public dashboards discloses all direct mode datasources
When using public dashboards and direct data-sources, all direct data-sources’ passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve...
CVE-2025-7741: Use of Hard-coded Password
Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account PROG used for CENTUM Authentication Mode within the system. Under the following conditions, there is a risk that an attacker could log in as the PROG user. The default...
CVE-2026-33373
An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...
CVE-2026-33373
An issue was discovered in Zimbra Collaboration ZCS 10.0 and 10.1. A Cross-Site Request Forgery CSRF vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state transitions. Specifically, tokens generated after...
Debian dla-4517 : roundcube - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4517 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4517-1 [email protected] https://www.debian.org/lts/security/...
Weak Password Requirements
Overview @openclaw/synology-chat is a Synology Chat channel plugin for OpenClaw Affected versions of this package are vulnerable to Weak Password Requirements due to insufficient rate limiting in the webhook authentication process. An attacker can repeatedly guess weak webhook tokens by sending...
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the verifyPassword endpoint. An attacker can obtain sensitive authentication data, such as MFA TOTP...
GHSA-WP76-GG32-8258 Parse Server exposes auth data via verify password endpoint
Impact The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection. Patch...