10932 matches found
EUVD-2025-206374
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and...
CVE-2025-59105
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and...
CVE-2025-59102 Secrets Stored in Plaintext in Database in dormakaba access manager
The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with...
PT-2026-4755
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and...
PT-2026-4791
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials...
CVE-2026-0767
Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2025-52026
An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 ...
Denial-Of-Service (DoS)
ESPHome is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to an integer overflow in the API protobuf decoder, where an attacker-controlled fieldlength value can overflow the bounds check in proto.cpp, bypassing validation and causing invalid memory access that crashes the device,...
CVE-2026-0767
Rejected reason: Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue...
CVE-2026-0767
This CVE ID is rejected and does not represent an active vulnerability entry, as explicitly stated in the Initial Description.
CVE-2026-0767
Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw...
PT-2026-4531
Name of the Vulnerable Software and Affected Versions Aptsys gemscms backend platform versions prior to 2025-05-29 Description An information disclosure issue exists in the /srvs/membersrv/getCashiers API endpoint of the Aptsys gemscms backend platform. This unauthenticated endpoint reveals a lis...
Dell ECS and Dell ObjectScale security vulnerabilities
Dell ECS and Dell ObjectScale are both products of the American company Dell. Dell ECS is an scalable, manageable, and elastic enterprise-level object storage solution. Dell ObjectScale is an object storage platform. There are security vulnerabilities in versions 3.8.1.0 to 3.8.1.7 of Dell ECS, a...
Open WebUI security vulnerabilities
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a security vulnerability that stems from transmitting sensitive information in plaintext when handling credentials, which may lead to information leakage...
Dell ECS security vulnerabilities
Dell ECS is an enterprise-level object storage solution from the American company Dell. Versions 3.8.1.0 to 3.8.1.7 of Dell ECS, as well as versions prior to 4.2.0.0 of Dell ObjectScale, have security vulnerabilities. These vulnerabilities stem from the transmission of sensitive information in...
Dell ECS security vulnerabilities
Dell ECS is an enterprise-level object storage solution from the American company Dell. Versions 3.8.1.0 to 3.8.1.7 of Dell ECS, as well as versions prior to 4.2.0.0 of Dell ObjectScale, have security vulnerabilities. These vulnerabilities stem from the transmission of sensitive information in...
CVE-2025-25051 AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password
An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks...
CVE-2025-25051 AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password
An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks...
CVE-2025-25051
CVE-2025-25051 pertains to AutomationDirect CLICK PLC, where the vulnerability arises from plaintext storage of a password in the project file. An attacker with access to the project file could decrypt credentials, impersonate legitimate users or devices, and potentially access network resources ...