Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store...
CVE-2026-116198
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext i
#cwe-311
共收录 25 条相关情报。
← 返回所有主题Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers l...
CVE-2026-116198
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext i
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
CVE-2026-43854
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials f
AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-111063
### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext
CVE-2026-78860
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plainte
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handle...
CVE-2026-105179
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the
Applications built on MongoDB Entity Framework Core Provider which place a database name in the...
CVE-2026-92757
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may in
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption...
CVE-2026-92756
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
CVE-2026-92757
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may in
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and sche...
CVE-2026-92756
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this prov
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job...
CVE-2026-84676
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the J
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with ...
CVE-2026-84676
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the J
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to ...
CVE-2026-81688
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metada
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker...
CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB
openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256
CVE-2026-81688
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metada
openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth...
CVE-2026-77812
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encry
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone ove...
CVE-2026-77812
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encry
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This m...
CVE-2026-19891
A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept tr