Common Weakness Enumeration
CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
432 vulnerabilities reference this CWE, most recent first.
CVE-2026-4250 (GCVE-0-2026-4250)
Vulnerability from cvelistv5 – Published: 2026-03-16 15:32 – Updated: 2026-03-16 18:12
VLAI
EPSS
VEX
Title
Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage
Summary
A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/assets/service-account.json of the component Google Cloud Service Account Key Handler. Performing a manipulation results in unprotected storage of credentials. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:11 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351208 | vdb-entry |
| https://vuldb.com/?ctiid.351208 | signaturepermissions-required |
| https://vuldb.com/?submit.771435 | third-party-advisory |
| https://www.notion.so/Google-Cloud-Service-Accoun… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Albert Sağlık Hizmetleri ve Ticaret | Albert Health |
Affected:
1.7.0
Affected: 1.7.1 Affected: 1.7.2 Affected: 1.7.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4250",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:11:17.072584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:12:04.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Google Cloud Service Account Key Handler"
],
"product": "Albert Health",
"vendor": "Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret",
"versions": [
{
"status": "affected",
"version": "1.7.0"
},
{
"status": "affected",
"version": "1.7.1"
},
{
"status": "affected",
"version": "1.7.2"
},
{
"status": "affected",
"version": "1.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/assets/service-account.json of the component Google Cloud Service Account Key Handler. Performing a manipulation results in unprotected storage of credentials. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:32:08.686Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351208 | Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.351208"
},
{
"name": "VDB-351208 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351208"
},
{
"name": "Submit #771435 | albertHealth Albert Health(albert.health) 1.7.3 Google Cloud Service Account Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771435"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Unauthorized-Data-Access-in-albert-health-3192de3f97fb800d8ebddef9f259223b?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-16T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:16:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4250",
"datePublished": "2026-03-16T15:32:08.686Z",
"dateReserved": "2026-03-16T06:06:30.949Z",
"dateUpdated": "2026-03-16T18:12:04.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4243 (GCVE-0-2026-4243)
Vulnerability from cvelistv5 – Published: 2026-03-16 15:02 – Updated: 2026-03-16 18:18
VLAI
EPSS
VEX
Title
La Nacion App app.lanacion.activity BuildConfig.java credentials storage
Summary
A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:18 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351185 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351185 | signaturepermissions-required |
| https://vuldb.com/?submit.771432 | third-party-advisory |
| https://www.notion.so/WebSocket-Credential-Leak-L… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | La Nacion App |
Affected:
10.2.25
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:18:16.241233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:18:28.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app.lanacion.activity"
],
"product": "La Nacion App",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "10.2.25"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:02:07.721Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351185 | La Nacion App app.lanacion.activity BuildConfig.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351185"
},
{
"name": "VDB-351185 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351185"
},
{
"name": "Submit #771432 | SA LA NACION LA NACION(app.lanacion.activity) 10.2.25 WebSocket Credential Leak",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771432"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-15T21:53:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "La Nacion App app.lanacion.activity BuildConfig.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4243",
"datePublished": "2026-03-16T15:02:07.721Z",
"dateReserved": "2026-03-15T20:48:26.368Z",
"dateUpdated": "2026-03-16T18:18:28.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4242 (GCVE-0-2026-4242)
Vulnerability from cvelistv5 – Published: 2026-03-16 14:32 – Updated: 2026-03-16 18:41
VLAI
EPSS
VEX
Title
BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage
Summary
A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:41 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351184 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351184 | signaturepermissions-required |
| https://vuldb.com/?submit.771429 | third-party-advisory |
| https://www.notion.so/Segment-Write-Key-Exposure-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BabyChakra | Pregnancy & Parenting App |
Affected:
5.4.0
Affected: 5.4.1 Affected: 5.4.2 Affected: 5.4.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4242",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:41:11.426519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:41:38.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app.babychakra.babychakra"
],
"product": "Pregnancy \u0026 Parenting App",
"vendor": "BabyChakra",
"versions": [
{
"status": "affected",
"version": "5.4.0"
},
{
"status": "affected",
"version": "5.4.1"
},
{
"status": "affected",
"version": "5.4.2"
},
{
"status": "affected",
"version": "5.4.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in BabyChakra Pregnancy \u0026 Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file\u00a0app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T14:32:08.907Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351184 | BabyChakra Pregnancy \u0026 Parenting App app.babychakra.babychakra Configuration.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351184"
},
{
"name": "VDB-351184 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351184"
},
{
"name": "Submit #771429 | BabyChakra Pregnancy \u0026 Parenting App(app.babychakra.babychakra) 5.4.3.0 Segment Write Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771429"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-app-babychakra-3192de3f97fb8084b6b5cb06f96cdf57?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:33:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "BabyChakra Pregnancy \u0026 Parenting App app.babychakra.babychakra Configuration.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4242",
"datePublished": "2026-03-16T14:32:08.907Z",
"dateReserved": "2026-03-15T20:46:40.333Z",
"dateUpdated": "2026-03-16T18:41:38.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4217 (GCVE-0-2026-4217)
Vulnerability from cvelistv5 – Published: 2026-03-16 05:02 – Updated: 2026-03-16 15:29
VLAI
EPSS
VEX
Title
XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage
Summary
A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unprotected storage of credentials. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 15:29 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351141 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351141 | signaturepermissions-required |
| https://vuldb.com/?submit.770503 | third-party-advisory |
| https://www.notion.so/Exposed-Cryptographic-Key-a… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XREAL | Nebula App |
Affected:
3.2.0
Affected: 3.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4217",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T15:29:47.821375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:29:54.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"ai.nreal.nebula.universal"
],
"product": "Nebula App",
"vendor": "XREAL",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in\u00a0ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unprotected storage of credentials. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T06:28:07.599Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351141 | XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351141"
},
{
"name": "VDB-351141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351141"
},
{
"name": "Submit #770503 | XREAL Technology Limited Nebula 3.2.1 Exposed Cryptographic Key and IV",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.770503"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Exposed-Cryptographic-Key-and-IV-in-ai-nreal-nebula-universal-3172de3f97fb80b5a987eac2c49527e2?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:32:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4217",
"datePublished": "2026-03-16T05:02:10.796Z",
"dateReserved": "2026-03-15T15:14:12.416Z",
"dateUpdated": "2026-03-16T15:29:54.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2380 (GCVE-0-2026-2380)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:48 – Updated: 2026-09-16 14:07
VLAI
EPSS
VEX
Title
Security Advisory 0168
Summary
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include:
- Sensitive CLI commands (e.g., "username bob secret myPass")
- Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:01 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , < 4.36.0F (custom) Affected: 4.34.0F , < 4.35.0F (custom) Affected: 4.33.0F , < 4.34.0F (custom) Affected: 0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:01:30.909167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:07:36.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThan": "4.36.0F",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThan": "4.35.0F",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThan": "4.34.0F",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable to CVE-2026-2380, any of the following configurations must be present:\u003c/p\u003e\u003col\u003e\u003cli\u003egNMI server is enabled\u003c/li\u003e\u003cli\u003eRESTCONF server is enabled\u003c/li\u003e\u003cli\u003eNETCONF server is enabled\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\u003c/p\u003e\u003cp\u003egNMI server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\u003c/pre\u003e\u003cp\u003eRESTCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section restconf\nmanagement api restconf\n transport https default\n ssl profile mySslProfile\u003c/pre\u003e\u003cp\u003eNETCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section netconf\nmanagement api netconf\n transport ssh default\u003c/pre\u003e\u003cp\u003eIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\u003c/p\u003e\u003cp\u003egRPC AAA accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\n accounting requests\u003c/pre\u003e\u003cp\u003egNSI.Acctz accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\n#show running-config section gnsi\nmanagement api gnsi\n service acctz\u003c/pre\u003e\u003cp\u003eOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\u003c/p\u003e\u003cpre\u003e#\ntrace OpenConfig setting */*\u003c/pre\u003e\u003cp\u003eOcta agent with debug tracing enabled (at any level):\u003c/p\u003e\u003cpre\u003e#show running-config section trace | grep Octa\ntrace Octa setting */*\u003c/pre\u003e"
}
],
"value": "To be vulnerable to CVE-2026-2380, any of the following configurations must be present:\n\n1. gNMI server is enabled\n2. RESTCONF server is enabled\n3. NETCONF server is enabled\n\nWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\n\ngNMI server enabled:\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n\nRESTCONF server enabled:\n\n #show running-config section restconf\n management api restconf\n transport https default\n ssl profile mySslProfile\n\nNETCONF server enabled:\n\n #show running-config section netconf\n management api netconf\n transport ssh default\n\nIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\n\ngRPC AAA accounting sensitive logging (for gNMI only):\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n accounting requests\n\ngNSI.Acctz accounting sensitive logging (for gNMI only):\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n #show running-config section gnsi\n management api gnsi\n service acctz\n\nOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\n\n #\n trace OpenConfig setting */*\n\nOcta agent with debug tracing enabled (at any level):\n\n #show running-config section trace | grep Octa\n trace Octa setting */*"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eExamples of sensitive information include:\u003c/p\u003e\u003cul\u003e\u003cli\u003eSensitive CLI commands (e.g., \u0026quot;username bob secret myPass\u0026quot;)\u003c/li\u003e\u003cli\u003eSensitive OpenConfig YANG leafs (e.g., \u0026quot;system/aaa/global/tacacs/config/secret-key\u0026quot;)\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\n\nExamples of sensitive information include:\n- Sensitive CLI commands (e.g., \"username bob secret myPass\")\n- Sensitive OpenConfig YANG leafs (e.g., \"system/aaa/global/tacacs/config/secret-key\")\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:36.641Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0168",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-2380 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-2380 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0168",
"defects": [
"BUG 1207374"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0168",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \u0026quot;trace OpenConfig setting */*\u0026quot; or \u0026quot;trace Octa setting */*\u0026quot;; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\u003c/p\u003e\u003cp\u003eShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up OpenConfig and Octa log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\u003c/pre\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete\u003c/pre\u003e"
}
],
"value": "The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \"trace OpenConfig setting */*\" or \"trace Octa setting */*\"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\n\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\n\nUse the following commands to clean up OpenConfig and Octa log files:\n\n switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\n switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\n\nThen use the following commands to clean up previously rotated old log files:\n\n switch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\n switch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-2380",
"datePublished": "2026-09-16T08:48:53.473Z",
"dateReserved": "2026-02-11T21:25:18.920Z",
"dateUpdated": "2026-09-16T14:07:36.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0017
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records
Summary
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0012
----------------------------------------------------------------------------
[-] Summary:
kamalpanse18 EmpManageX, a Flask-based employee management application,
ships hard-coded administrative credentials in its authentication logic.
The username admin and the plaintext password admin123 are module-level
constants in app.py, compared directly against the values submitted to the
/api/login handler. An attacker who can reach the listener authenticates as
the sole administrator and obtains full read and write control of every
employee record. The credentials are not a guessable secret: the project's
own README.md and QUICK_START.md state them openly. As shipped the server
binds to 127.0.0.1 only, so the default exposure is local; a deployer who
binds an external interface makes the same defect remotely reachable.
CVSS:3.1 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
[-] Affected:
kamalpanse18 EmpManageX, all versions (app.py).
The repository has a single commit, f4de83b, dated 2025-12-31, and no
tagged releases. No fixed version is currently verified.
[-] Technical Description:
ADMIN_USERNAME and ADMIN_PASSWORD are assigned at lines 17-18 of app.py and
compared directly against the submitted values in the /api/login handler.
The credential pair is a source-level constant with no configuration
mechanism behind it: app.py contains no use of os.environ or os.getenv, no
configuration file, no first-run setup step and no password-change
endpoint. The only supported way to alter the administrator password is to
edit the source and restart the process, and that change is lost whenever
the deployment is refreshed from the upstream repository. The same value is
therefore present in every unmodified deployment, and because README.md and
QUICK_START.md state it openly it is a published constant rather than a
guessable secret.
A successful call to /api/login sets session['logged_in'], which is the
only condition tested by the login_required decorator. No further
authorisation check is performed, so the caller obtains the entire
protected surface: POST /api/employee (create), GET /api/employees and
GET /api/employee/<int:emp_id> (read all stored employee data),
PUT /api/employee/<int:emp_id> (modify) and
DELETE /api/employee/<int:emp_id> (delete). On a match the handler sets
session['user_id'], session['username'] and session['logged_in'] and
returns a signed session cookie marked permanent with a 24-hour lifetime,
which the caller can replay against the protected endpoints.
The entry point is app.run(debug=True, port=5000), which passes no host
argument and therefore binds the Werkzeug development server to 127.0.0.1
only; README.md, SETUP_GUIDE.md and QUICK_START.md all direct the user to
http://127.0.0.1:5000. In the configuration as shipped the endpoint is
reachable only from the local host, which is what the CVSS vector above
reflects. A deployer who binds 0.0.0.0 or places the application behind a
reverse proxy makes the same defect remotely reachable.
SETUP_GUIDE.md carries a "Security Recommendations for Production" section
suggesting that the credentials be read from environment variables, but
that guidance is not implemented in the shipped app.py, and the example it
gives retains admin/admin123 as the fallback default.
The step-by-step attack path and the full write-up are published at the
advisory URL below.
Weaknesses:
CWE-798: Use of Hard-coded Credentials
CWE-1392: Use of Default Credentials
CWE-256: Plaintext Storage of a Password
CAPEC-70: Try Common or Default Usernames and Passwords
[-] Timeline:
[29/07/2026] - Report received and NotCVE ID reserved.
[20/08/2026] - Published as NotCVE-2026-0012.
[-] Credit:
Discovered by netspacer1124.
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0012
[-] References:
https://github.com/kamalpanse18/EmpManageX
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md
https://github.com/kamalpanse18/EmpManageX/commits/main/app.py
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | EmpManageX Hardcoded Administrative |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "EmpManageX Hardcoded Administrative",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0012\n----------------------------------------------------------------------------\n\n[-] Summary:\nkamalpanse18 EmpManageX, a Flask-based employee management application,\nships hard-coded administrative credentials in its authentication logic.\nThe username admin and the plaintext password admin123 are module-level\nconstants in app.py, compared directly against the values submitted to the\n/api/login handler. An attacker who can reach the listener authenticates as\nthe sole administrator and obtains full read and write control of every\nemployee record. The credentials are not a guessable secret: the project\u0027s\nown README.md and QUICK_START.md state them openly. As shipped the server\nbinds to 127.0.0.1 only, so the default exposure is local; a deployer who\nbinds an external interface makes the same defect remotely reachable.\nCVSS:3.1 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\n[-] Affected:\nkamalpanse18 EmpManageX, all versions (app.py).\nThe repository has a single commit, f4de83b, dated 2025-12-31, and no\ntagged releases. No fixed version is currently verified.\n\n[-] Technical Description:\nADMIN_USERNAME and ADMIN_PASSWORD are assigned at lines 17-18 of app.py and\ncompared directly against the submitted values in the /api/login handler.\nThe credential pair is a source-level constant with no configuration\nmechanism behind it: app.py contains no use of os.environ or os.getenv, no\nconfiguration file, no first-run setup step and no password-change\nendpoint. The only supported way to alter the administrator password is to\nedit the source and restart the process, and that change is lost whenever\nthe deployment is refreshed from the upstream repository. The same value is\ntherefore present in every unmodified deployment, and because README.md and\nQUICK_START.md state it openly it is a published constant rather than a\nguessable secret.\n\nA successful call to /api/login sets session[\u0027logged_in\u0027], which is the\nonly condition tested by the login_required decorator. No further\nauthorisation check is performed, so the caller obtains the entire\nprotected surface: POST /api/employee (create), GET /api/employees and\nGET /api/employee/\u003cint:emp_id\u003e (read all stored employee data),\nPUT /api/employee/\u003cint:emp_id\u003e (modify) and\nDELETE /api/employee/\u003cint:emp_id\u003e (delete). On a match the handler sets\nsession[\u0027user_id\u0027], session[\u0027username\u0027] and session[\u0027logged_in\u0027] and\nreturns a signed session cookie marked permanent with a 24-hour lifetime,\nwhich the caller can replay against the protected endpoints.\n\nThe entry point is app.run(debug=True, port=5000), which passes no host\nargument and therefore binds the Werkzeug development server to 127.0.0.1\nonly; README.md, SETUP_GUIDE.md and QUICK_START.md all direct the user to\nhttp://127.0.0.1:5000. In the configuration as shipped the endpoint is\nreachable only from the local host, which is what the CVSS vector above\nreflects. A deployer who binds 0.0.0.0 or places the application behind a\nreverse proxy makes the same defect remotely reachable.\n\nSETUP_GUIDE.md carries a \"Security Recommendations for Production\" section\nsuggesting that the credentials be read from environment variables, but\nthat guidance is not implemented in the shipped app.py, and the example it\ngives retains admin/admin123 as the fallback default.\n\nThe step-by-step attack path and the full write-up are published at the\nadvisory URL below.\n\nWeaknesses:\nCWE-798: Use of Hard-coded Credentials\nCWE-1392: Use of Default Credentials\nCWE-256: Plaintext Storage of a Password\nCAPEC-70: Try Common or Default Usernames and Passwords\n\n[-] Timeline:\n[29/07/2026] - Report received and NotCVE ID reserved.\n[20/08/2026] - Published as NotCVE-2026-0012.\n\n[-] Credit:\nDiscovered by netspacer1124.\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0012\n\n[-] References:\nhttps://github.com/kamalpanse18/EmpManageX\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md\nhttps://github.com/kamalpanse18/EmpManageX/commits/main/app.py\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-256",
"description": "CWE-256",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:20Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/113"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/113"
},
{
"url": "http://127.0.0.1:5000"
},
{
"url": "https://github.com/kamalpanse18/EmpManageX"
},
{
"url": "https://github.com/kamalpanse18/EmpManageX/commits/main/app.py"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0012"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/113"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0017",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/113",
"automated": true,
"contentSha256": "c95c4d5678b820a7ef5f1419342a923a1af431905e7d094b5c6553d19da8dda2",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/113",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-21T10:27:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-07T13:20:20Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0017"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65009 (GCVE-0-2025-65009)
Vulnerability from cvelistv5 – Published: 2025-12-18 15:10 – Updated: 2025-12-18 18:52
VLAI
EPSS
VEX
Title
Insecure Password Storage in WODESYS WD-R608U router
Summary
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-18 15:18 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.wodesys.com/eproductms52.html | product |
| https://cert.pl/en/posts/2025/12/CVE-2025-65007 | third-party-advisory |
| https://github.com/wcyb/security_research | exploit |
Impacted products
Date Public
2025-12-18 15:09
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-18T15:18:52.153666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-18T18:52:06.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WD-R608U",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WDR28",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WDR122B V2.0",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wojciech Cybowski"
}
],
"datePublic": "2025-12-18T15:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In WODESYS WD-R608U router (also known as \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWDR122B V2.0 and WDR28)\u003c/span\u003e\u0026nbsp;\u003cspan style=\"background-color: rgba(221, 223, 228, 0.1);\"\u003eadmin password is stored in configuration file as plaintext\u003c/span\u003e\u0026nbsp;and can be obtained by unauthorized user by direct references to the resource in question.\u003cbr\u003e\u003cbr\u003eThe vendor was notified early about this vulnerability, but didn\u0027t respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\u003cbr\u003e"
}
],
"value": "In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28)\u00a0admin password is stored in configuration file as plaintext\u00a0and can be obtained by unauthorized user by direct references to the resource in question.\n\nThe vendor was notified early about this vulnerability, but didn\u0027t respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-18T15:10:31.234Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"product"
],
"url": "http://www.wodesys.com/eproductms52.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2025/12/CVE-2025-65007"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wcyb/security_research"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure Password Storage in WODESYS WD-R608U router",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-65009",
"datePublished": "2025-12-18T15:10:31.234Z",
"dateReserved": "2025-11-13T09:42:15.302Z",
"dateUpdated": "2025-12-18T18:52:06.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-61680 (GCVE-0-2025-61680)
Vulnerability from cvelistv5 – Published: 2025-10-03 21:37 – Updated: 2025-10-06 15:43
VLAI
EPSS
VEX
Title
Minecraft RCON Terminal: Plain Text Password Storage in Configuration
Summary
Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-06 15:43 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jaketcooper/Minecraft-rcon/sec… | x_refsource_CONFIRM |
| https://github.com/jaketcooper/Minecraft-rcon/com… | x_refsource_MISC |
| https://github.com/jaketcooper/Minecraft-rcon/rel… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jaketcooper | Minecraft-rcon |
Affected:
>= 0.1.0, < 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-61680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-06T15:43:25.467679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T15:43:41.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Minecraft-rcon",
"vendor": "jaketcooper",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code\u0027s configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256: Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-03T21:37:31.341Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77"
},
{
"name": "https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877"
},
{
"name": "https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0"
}
],
"source": {
"advisory": "GHSA-4m33-hxqw-7j77",
"discovery": "UNKNOWN"
},
"title": "Minecraft RCON Terminal: Plain Text Password Storage in Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-61680",
"datePublished": "2025-10-03T21:37:31.341Z",
"dateReserved": "2025-09-29T20:25:16.181Z",
"dateUpdated": "2025-10-06T15:43:41.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-48046 (GCVE-0-2025-48046)
Vulnerability from cvelistv5 – Published: 2025-05-29 12:33 – Updated: 2025-09-05 08:30
VLAI
EPSS
VEX
Title
MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext
Summary
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-29 13:16 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.rapid7.com/blog/post/2025/05/29/cve-2… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MICI Network Co. Ltd. | NetFax Server |
Affected:
0 , < 3.0.1.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48046",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-29T13:16:10.487202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-29T13:16:45.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "NetFax Server",
"vendor": "MICI Network Co. Ltd.",
"versions": [
{
"lessThan": "3.0.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Anna Quinn, Security Consultant at Rapid7"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint."
}
],
"value": "An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256: Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T08:30:09.250Z",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2025-48046",
"datePublished": "2025-05-29T12:33:27.734Z",
"dateReserved": "2025-05-15T13:38:26.770Z",
"dateUpdated": "2025-09-05T08:30:09.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-46809 (GCVE-0-2025-46809)
Vulnerability from cvelistv5 – Published: 2025-07-31 15:24 – Updated: 2025-09-03 07:12
VLAI
EPSS
VEX
Title
Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs
Summary
A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-31 20:08 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| SUSE | Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1 |
Affected:
? , < 5.0.14-150600.4.17.1
(custom)
|
|
| SUSE | Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 |
Affected:
? , < 5.0.14-150600.4.17.1
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Proxy-4-3-BYOS |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Server-4-3-BYOS |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | SUSE Manager Proxy Module 4.3 |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
|
| SUSE | SUSE Manager Server Module 4.3 |
Affected:
? , < 4.3.33-150400.3.55.2
(custom)
|
Date Public
2025-07-23 12:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-46809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-31T20:08:05.402246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-31T20:08:17.438Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1",
"vendor": "SUSE",
"versions": [
{
"lessThan": "5.0.14-150600.4.17.1",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1",
"vendor": "SUSE",
"versions": [
{
"lessThan": "5.0.14-150600.4.17.1",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Proxy-4-3-BYOS",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Server-4-3-BYOS",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "SUSE Manager Proxy Module 4.3",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "spacewalk-backend",
"product": "SUSE Manager Server Module 4.3",
"vendor": "SUSE",
"versions": [
{
"lessThan": "4.3.33-150400.3.55.2",
"status": "affected",
"version": "?",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Oscar Barrios of SUSE"
}
],
"datePublic": "2025-07-23T12:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files.\u0026nbsp;\u003cp\u003eThis issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.\u003c/p\u003e"
}
],
"value": "A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files.\u00a0This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256: Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-03T07:12:41.584Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46809"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2025-46809",
"datePublished": "2025-07-31T15:24:41.890Z",
"dateReserved": "2025-04-30T11:28:04.728Z",
"dateUpdated": "2025-09-03T07:12:41.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Architecture and Design
Avoid storing passwords in easily accessible locations.
Mitigation
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.