CVE-2026-61614: Use of GET Request Method With Sensitive Query Strings

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

CVE-2026-62386

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...

CVE-2026-11820

A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...

CVE-2026-10078

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to th...

CVE-2026-23846

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially...

The Rise of S3 Ransomware: How to Identify and Combat It

In today's digital landscape, around 60% of corporate data now resides in the cloud, with Amazon S3 standing as the backbone of data storage for many major corporations. Despite S3 being a secure service from a reputable provider, its pivotal role in handling vast amounts of sensitive data custom...

USN-5585-1 jupyter-notebook vulnerabilities

It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting XSS attacks on the notebook server. This issue only affected Ubuntu 18.04 LTS. CVE-2018-19351 It...

CVE-2015-7929: Exposure of Sensitive Information to an Unauthorized Actor

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

PT-2015-7676

Name of the Vulnerable Software and Affected Versions eWON devices with firmware through 10.1s0 Description The issue allows remote attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, due to the support of unspecified GET...

CVE-2015-1999: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2014-6075: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-serv...

CVE-2014-3303: Exposure of Sensitive Information to an Unauthorized Actor

The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81713...

PT-2014-5192

Name of the Vulnerable Software and Affected Versions Cisco Intelligent Automation for Cloud in Cisco Cloud Portal affected versions not specified Description The issue allows remote authenticated users to obtain sensitive information by reading web-server access logs, web-server Referer logs, or...

CVE-2014-3294: Undefined Security Weakness

Cisco WebEx Meeting Server does not properly restrict the content of URLs, which allows remote authenticated users to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81691...

PT-2014-5189

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Server affected versions not specified Description The issue allows remote authenticated users to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history...

PT-2014-4675

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.2.2-rev20 Open-Xchange AppSuite versions prior to 7.4.1-rev11 Open-Xchange AppSuite versions prior to 7.4.2-rev13 Description The password recovery service in Open-Xchange AppSuite makes an improper...

CVE-2014-2392: Exposure of Sensitive Information to an Unauthorized Actor

The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs...

PT-2014-4676

Name of the Vulnerable Software and Affected Versions Open-Xchange AppSuite versions prior to 7.2.2-rev20 Open-Xchange AppSuite versions prior to 7.4.1-rev11 Open-Xchange AppSuite versions prior to 7.4.2-rev13 Description The E-Mail autoconfiguration feature in Open-Xchange AppSuite places a...

CVE-2014-0708: Exposure of Sensitive Information to an Unauthorized Actor

WebEx Meeting Center in Cisco WebEx Business Suite does not properly compose URLs for HTTP GET requests, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 a browser's history, aka Bug ID CSCul98272...

PT-2014-3783

Name of the Vulnerable Software and Affected Versions Cisco WebEx Business Suite affected versions not specified Description The issue concerns the WebEx Meeting Center component in Cisco WebEx Business Suite, which fails to properly compose URLs for HTTP GET requests. This allows remote attacker...