11 matches found
CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
EEF-CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Summary Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
CVE-2026-81632: Use of GET Request Method With Sensitive Query Strings
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
CVE-2026-47768: Use of GET Request Method With Sensitive Query Strings
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...
CVE-2026-9592: Use of GET Request Method With Sensitive Query Strings
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...
CVE-2026-43875: Use of GET Request Method With Sensitive Query Strings
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user= &pass= where is the victim's stored password hash md5hash"whirlpool", sha1password read directly fr...
BlackVue App 安全漏洞
BlackVue App is a software from BlackVue with car recorder connectivity. It is used to read the video data from the recorder, view the vehicle's driving history, etc. A security vulnerability exists in BlackVue App version 3.65, which stems from a GET request method that uses a sensitive query...
EQS Integrity Line Cross Site Scripting / Information Disclosure
EQS Integrity Line: Multiple Vulnerabilities Name Multiple Vulnerabilities in EQS Integrity Line Systems Affected EQS Integrity Line through 2022-07-01 Severity High Impact CVSSv2 High 8.8/10, score: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vendor EQS Group AG https://www.eqs.com/ Advisory...
Dell EMC PowerScale OneFS Information Disclosure Vulnerability
Dell EMC PowerScale OneFS, an API-driven file system, is vulnerable to an information disclosure in Dell EMC PowerScale OneFS version 8.2.2-9.1.0.. The vulnerability stems from the product's use of a get request method with a sensitive query string. An attacker could exploit the vulnerability to...