3364 matches found
Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082
The module enables you to add second-factor authentication on top of the default Drupal login. The module does not sufficiently ensure that known authorization routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password...
CVE-2025-1349 IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...
CVE-2025-45784
D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...
CVE-2025-45784
D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...
CVE-2025-49188
The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering...
CVE-2025-49188
CVE-2025-49188 affects SICK Field Analytics and SICK Media Server. The root cause is transmitting user credentials via URL parameters instead of POST bodies, enabling information gathering and potential confidentiality impact. Public exploit details are not provided in the connected documents. Se...
CVE-2025-49188 Sensitive Data in URL
The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering...
CVE-2025-49188 Sensitive Data in URL
The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering...
PT-2025-25314 · Sick Ag · Sick Field Analytics
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering. Recommendations: At the moment, there is no information about ...
CVE-2025-49653
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
CVE-2025-47849
A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 . A malicious Domain Admin user in the ROOT domain can bypass restrictions to obtain the API key and secret key of user-accounts with an Admin role type in the same domain. This allows the attacker...
Security Vulnerabilities fixed in Thunderbird 128.11.1 — Mozilla
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...
GHSA-V3PH-2Q5Q-CG88 @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Summary In the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. Affected Resources - Operations.php:868 -...
GHSA-HXVR-GG2W-J48X BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...
CVE-2025-49653
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
CVE-2025-49653
CVE-2025-49653 concerns Lablup’s BackendAI. The vulnerability arises from exposure of sensitive data in active sessions, enabling an attacker to retrieve credentials for users on the management platform. The affected software is BackendAI (backend.ai) and specifically involves credentials exposur...
CVE-2025-49653 Exposure of sensitive Information allows account takeover
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform...
PT-2025-24548
Name of the Vulnerable Software and Affected Versions Lablup's BackendAI affected versions not specified Description The issue allows attackers to expose sensitive data in active sessions, enabling them to retrieve credentials for users on the management platform. Recommendations At the moment,...
Lablup BackendAI security vulnerabilities
Lablup BackendAI is a machine learning platform from Lablup Korea. A security vulnerability exists in Lablup BackendAI that stems from the exposure of sensitive data in active sessions, which could lead to an attacker gaining access to management platform user credentials...