Boruta: OAuth credentials exposed in Boruta business logs
CVE-2026-55221
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
#cwe-532
共收录 246 条相关情报。
← 返回所有主题free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/u...
CVE-2026-55785
free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptograph
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
CVE-2026-55785
### Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers inste
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and ...
CVE-2026-78174
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-priv
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be rep...
CVE-2026-81530
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management
Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
CVE-2026-59302
Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0
Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
CVE-2026-59301
Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Fu
Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Sp...
CVE-2026-59300
Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Func
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debu...
CVE-2026-81715
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the p
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abb...
CVE-2026-81705
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied vi
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding...
CVE-2026-75573
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is suppl
openssl_encrypt before 1.4.9 Credential Exposure via Debug Output
CVE-2026-81715
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the p
openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug
CVE-2026-81705
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied vi
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
CVE-2026-61798
## Summary `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes i
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers ...
CVE-2026-14948
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator p
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.
CVE-2026-14163
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with...
CVE-2026-76374
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with...
CVE-2026-76375
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that ...
CVE-2026-76375
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be wri...
CVE-2026-76374
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could