CVE-2019-18355

Thycotic Secret Server’s legacy Web launcher contains an SSRF vulnerability (CVE-2019-18355) in versions before 10.7. Connected sources corroborate that an SSRF issue affects the legacy Web launcher, with no public exploit details provided in the documents. The CVSS metrics indicate high to criti...

CVE-2019-18356

Thycotic Secret Server (

CVE-2019-18357

CVE-2019-18357 affects Thycotic Secret Server prior to 10.7. The issue is a cross-site scripting vulnerability in the web application caused by insufficient validation of client-side data, enabling potential injection of arbitrary scripts. Impact per sources indicates no confidentiality impact, b...

CVE-2015-3443

CVE-2015-3443 describes a stored cross-site scripting (XSS) vulnerability in Thycotic Secret Server. The issue affects Secret Server versions 8.6.x, 8.7.x, and 8.8.x prior to 8.8.000005, where a specially crafted password in the basic dashboard can trigger script execution when the password mask ...

CVE-2021-41845

CVE-2021-41845 is a SQL injection in ThycoticCentrify Secret Server. Affected are versions 10.9.000032 through 11.0.000006; fixed in 11.0.000007 (and later). The issue arises from unsafely constructed SQL statements in the server, enabling potential unauthorized database commands. The available s...

CVE-2017-11725

CVE-2017-11725 affects IBM Security Secret Server (Thycotic Secret Server) prior to 10.2.000019. The vulnerability resides in the share function where the Back Button is mishandled, causing unintended redirections (open redirect-like behavior) and potential user confusion or credential exposure r...

CVE-2014-4861

CVE-2014-4861 affects Thycotic Secret Server’s Remote Desktop Launcher, where a temporary file containing an encrypted password is not properly cleaned up after a session ends. This could expose credentials if the file persists. Affected: Secret Server prior to 8.6.000010. Root cause: inadequate ...

CVE-2015-4094

The CVE-2015-4094 issue affects Thycotic Password Manager Secret Server for iOS up to version 2.3. The root cause is failure to validate X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and access sensitive information via a crafted certificate. There are multiple con...