3117 matches found
GHSA-V3PH-2Q5Q-CG88 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Summary In the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. Affected Resources - Operations.php:868 -...
GHSA-HXVR-GG2W-J48X BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...
CVE-2025-49653
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
CVE-2025-49653 Exposure of sensitive Information allows account takeover
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
CVE-2025-49653
CVE-2025-49653 concerns Lablup’s BackendAI. The vulnerability arises from exposure of sensitive data in active sessions, enabling an attacker to retrieve credentials for users on the management platform. The affected software is BackendAI (backend.ai) and specifically involves credentials exposur...
PT-2025-24548
Name of the Vulnerable Software and Affected Versions Lablup's BackendAI affected versions not specified Description The issue allows attackers to expose sensitive data in active sessions, enabling them to retrieve credentials for users on the management platform. Recommendations At the moment,...
Lablup BackendAI 安全漏洞
Lablup BackendAI is a machine learning platform from Lablup Korea. A security vulnerability exists in Lablup BackendAI that stems from the exposure of sensitive data in active sessions, which could lead to an attacker gaining access to management platform user credentials...
CVE-2025-44614
Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext...
CVE-2025-44614
Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext...
CVE-2025-44614
CVE-2025-44614 affects Tinxy WiFi Lock Controller v1 RF. The issue is that the device/component stores users’ sensitive data (credentials and mobile numbers) in plaintext, creating potential information leakage. The core root cause is unencrypted storage of sensitive data on the device. As per re...
ZKTeco BioTime multiple vulnerabilities
RISK EVALUATION ZKTeco BioTime is a web-based time and attendance management software. A default password vulnerability was found that allows an attacker to log in to any user account that does not change their password. Attackers utilizing this obtain user credentials and can possibly perform...
CVE-2025-48926
The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers...
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to the reuse of starting credentials that do not regenerate between separate CR dependencies AMQPASSWORD, AMQUSER, AMQCLUSTERPASSWORD, and AMQCLUSTERUSER. An attacker can gain unauthorized access...
CVE-2024-47789
UNSUPPORTED WHEN ASSIGNED This vulnerability exists in D3D Security IP Camera D8801 due to usage of weak authentication scheme of the HTTP header protocol where authorization tag contain a Base-64 encoded username and password. A remote attacker could exploit this vulnerability by crafting a HTTP...
CVE-2024-41927
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated...
CVE-2024-25024
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430...
CVE-2024-38885
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application...
CVE-2024-28782
IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 285698...
CVE-2024-24300
4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged...