共收录 34 条相关安全情报。
← 返回所有主题Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JW
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JW
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem ea
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem ea
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
## Impact Operator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. - `internal/models/operator.go:61` — `OperatorSession.Token` holds the plaintext token. - `internal/store/sqlite_operators.go:590` — `CreateOperatorSession` inserts `se
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This iss
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in pu
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Summary When MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On Linux, `File.CreateText` creates files with mode `0644` (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
`internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `ConsumeToken` does `WHERE token = ?` against the raw string. Compare with `operator_api_keys.key_hash`, which is SHA-256 hex (constructed in `internal/api/middleware.go:51-53`). ## Affected All released versions up to v0.3.0. ## Threat model Read access to `nebula-mgmt.db`: backup, sn
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On L
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no f
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile dir
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
该漏洞影响 Windows 平台上的 StrongDM Desktop Application 版本低于 23.74.0（Desktop Client 低于 53.77.0）。漏洞根源在于应用程序将用户的认证状态（包括 JSON Web Token 和非对称密钥材料）以明文形式存储在用户目录下的 `C:\Users\<username>\.sdm\state.kv` 文件中。该文件仅受默认的用户级 NTFS 权限保护，这意味着任何能够以同一用户身份登录或具有本地读取权限的攻击者（如恶意软件、本地提权后的进程、共享计算机上的其他用户）均可访问该文件，从而窃取认证令牌和密钥材料。利用条件要求攻击者已具备受影响用户的配置文件目录的本地读访问权限，并且目标主机上还需满足额外的部署和执行条件。该漏洞由 Hope Walker (SpecterOps) 通过协调披露报告给厂商。受影响的用户应尽快升级到 StrongDM Desktop Application 23.74.0 或更高版本以及 Desktop Client 53.77.0 或更高版本，以消除明文存储敏感信息的安全风险。
💡 影响/原因: 认证令牌和密钥明文存储可能被本地攻击者窃取，导致账户接管或数据泄露。虽然利用需要本地访问，但在多用户或终端环境风险较高。
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with RUST_LOG=debug sensitive credentials including SessionToken (JWT), SecretAccessKey, and full JWT claims are printed in plaintext to the server logs. This vulnerability is fixed in 1.0.0-beta.2.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a rem
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Tech
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path betwee
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. This issue has been patched in versions 1.17.15, 1.18.9, and 1.19.3.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` object and sends it to the renderer. The data is stored as `window.pre.env` and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). On developer and CI machines, `process.env` routinely contains secrets such as: - `
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised web
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azu
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估