#cwe-522

共收录 306 条相关情报。

← 返回所有主题
漏洞预警2026-10-30 发布HIGH

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// U...

CVE-2026-116252

pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布HIGH

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the con...

CVE-2026-116247

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one coul

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布HIGH

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or clie...

CVE-2026-116245

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布HIGH

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to t...

CVE-2026-116244

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME fro

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布HIGH

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh ...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-30 发布CRITICAL

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `Static...

CVE-2026-61730

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected depl

来源摘录 · NVD

漏洞预警2026-10-30 发布MEDIUM

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potential...

CVE-2026-111502

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A l

来源摘录 · NVD

漏洞预警2026-10-30 发布MEDIUM

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to ...

CVE-2026-119566

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google I

来源摘录 · NVD

漏洞预警2026-10-29 发布HIGH

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that sto...

CVE-2026-118763

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/regis

来源摘录 · NVD / GitHub Advisory / OSV.dev

漏洞预警2026-10-29 发布MEDIUM

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain ...

CVE-2026-90861

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear

来源摘录 · NVD

漏洞预警2026-10-29 发布CRITICAL

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive ...

CVE-2026-84295

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allo

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

CVE-2026-110192

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentia...

CVE-2026-104314

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow

来源摘录 · NVD

漏洞预警2026-10-28 发布HIGH

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure acces...

CVE-2026-88967

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-contro

来源摘录 · NVD

漏洞预警2026-10-28 发布INFO

Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

CVE-2026-87097

Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acron

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-28 发布INFO

Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated ...

CVE-2026-104384

Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-27 发布HIGH

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a conf...

CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` un

来源摘录 · NVD

漏洞预警2026-10-27 发布INFO

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or r...

CVE-2026-116683

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored

来源摘录 · NVD

安全公告2026-10-27 发布INFO

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CVE-2026-116683

### Impact CTFer.io's CTFd Terraform Provider stores `ctfd_team.password` as non-sensitive values (CWE-522). A local or

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-27 发布INFO

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CVE-2026-116683

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored

历史摘要 · 未重新核验 · OSV.dev