The vulnerability of software for storing images in OpenEXR format, which has a wide dynamic range of brightness levels, arises from the possibility of the operation exceeding the buffer boundaries in memory. This allows an attacker to cause a service failure.

The vulnerability of software for storing images with a wide dynamic range of brightness in the OpenEXR format is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `unpack_32bit()` function in software for storing OpenEXR images with a wide dynamic range of brightness levels allows a hacker to cause a service failure.

The vulnerability of the unpack32bit function in software for storing OpenEXR images with a wide dynamic range of brightness levels is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-54199

Tobit Laboratories AG TeamDavid’s Webbox is vulnerable to HTTP header injection via the request body in the link-storing function (//ServerClient_celink.htm), which is appended to the redirect target in the 302 response. Inserting a line feed can propagate into the redirect URL, enabling control ...

PT-2026-68895

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request...

CVE-2026-54205: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54199: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

CVE-2026-22576: Storing Passwords in a Recoverable Format

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2,...

CVE-2026-22574: Storing Passwords in a Recoverable Format

A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2,...

CVE-2025-14295: Storing Passwords in a Recoverable Format

Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Format vulnerability CWE-257 in the Web session management component allows an attacker to access stored passwords in a recoverable format whi...

Flock Safety Gunshot Detection 安全漏洞

Flock Safety Gunshot Detection is a gunshot detection system from Flock Safety USA. A security vulnerability exists in Flock Safety Gunshot Detection versions prior to 1.3, which stems from the explicit storage of code...

CVE-2025-47010 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2024-32122

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server...

Netis Systems WF-2404 安全漏洞

The Netis Systems WF-2404 is a wireless router from Netis Systems. A security vulnerability exists in the Netis Systems WF-2404 version 1.1.124EN, which stems from the explicit storage of sensitive information that requires physical device access...

CVE-2021-22509

NetIQ Advance Authentication contains an information disclosure vulnerability (CVE-2021-22509) affecting versions prior to 6.3.5.1. The issue stems from storing and reusing sensitive data in the authentication process, which can lead to leakage to unauthorized users. Impact is described as inform...

CVE-2024-41689 Hard-coded Credentials Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WP...

CVE-2024-6833 Zowe CLI Auto-Init Leaks Credentials Locally

A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation...

Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities (CVE-2023-35006, CVE-2023-33859, CVE-2023-33860, CVE-2023-35008)

Summary IBM Security QRadar EDR Software is vulnerable to link injection and could also allow an attacker to embed links URLs to an external site or to different pages. Sensitive information could also be disclosed due to an observable login response discrepancy and web pages could be stored...