CWE-522

{
  "affected": [],
  "aliases": [
    "CVE-2022-2221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-27T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.",
  "id": "GHSA-9292-4cm7-5jcj",
  "modified": "2022-07-08T00:00:51Z",
  "published": "2022-06-28T00:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2221"
    },
    {
      "type": "WEB",
      "url": "https://devolutions.net/security/advisories/DEVO-2022-0004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-0212"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-15T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the system. This issue affects: Juniper Networks Contrail Networking versions prior to 1911.31.",
  "id": "GHSA-92rw-4752-77x9",
  "modified": "2022-05-24T17:39:20Z",
  "published": "2022-05-24T17:39:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0212"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA11102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-10960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-20T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.",
  "id": "GHSA-93pw-6hqj-6vh2",
  "modified": "2024-04-04T01:43:10Z",
  "published": "2022-05-24T16:54:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10960"
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-232-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.6.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pantheon-agents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.1"
            },
            {
              "fixed": "0.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-506",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:36:45Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\nThe PyPI account that publishes `pantheon-agents` was compromised in the June 2026 \"Hades\" PyPI supply-chain attack (Mini Shai-Hulud / Miasma lineage). The attacker used a stolen, long-lived PyPI API token to upload **trojanized releases `pantheon-agents` 0.6.1 and 0.6.2 directly to PyPI**.\n\n**Only the PyPI artifacts are affected.** The GitHub source repository, its git tags, and all other distribution channels are clean \u2014 no malicious code was committed to the repository.\n\n## Affected\n- `pantheon-agents` **0.6.1** and **0.6.2** on PyPI.\n\nNot affected: installs from the GitHub source, version 0.6.0 and earlier, and the Desktop / Online apps.\n\n## Indicators of compromise\nThe malicious wheels ship a `*-setup.pth` file that executes on Python startup. It downloads the Bun JavaScript runtime and runs an obfuscated credential stealer (`_index.js`) that harvests and exfiltrates credentials reachable from the host \u2014 environment variables, `~/.pypirc`, `~/.npmrc`, cloud credentials (`~/.aws`, etc.), SSH keys, and API tokens.\n\nCheck your environment\u0027s `site-packages` for an unexpected `*-setup.pth`, and your home directory for `_index.js` or a Bun runtime (`~/.bun`).\n\n## Impact\nAnyone who `pip install`ed `pantheon-agents` 0.6.1 or 0.6.2 should assume **every credential present on that machine has been exfiltrated.**\n\n## Remediation\n1. **Do not install `pantheon-agents` from PyPI** until distribution resumes.\n2. If you installed 0.6.1 or 0.6.2:\n   - Run `pip uninstall pantheon-agents` immediately and check for the IoCs above.\n   - **Rotate every credential** that was present on that machine (API keys, tokens, SSH keys, cloud credentials).\n3. Install only from the clean GitHub source:\n   ```\n   pip install \"git+https://github.com/aristoteleo/PantheonOS.git\"\n   ```\n\n## Status\nThe PyPI account is suspended and the malicious token has been disabled. PyPI distribution will resume after account recovery and migration to PyPI Trusted Publishing (OIDC). Sibling projects by the same maintainer (e.g. executor-engine, funcdesc, cmd2func, pantheon-toolsets, coolbox, ufish, magique, executor-http) were hit by the same campaign and are being remediated separately.",
  "id": "GHSA-93qj-5q5v-3c2h",
  "modified": "2026-08-26T14:36:45Z",
  "published": "2026-08-26T14:36:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aristoteleo/PantheonOS/security/advisories/GHSA-93qj-5q5v-3c2h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aristoteleo/PantheonOS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-15921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-24T01:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution.",
  "id": "GHSA-943p-3v8v-q53x",
  "modified": "2024-04-04T02:54:59Z",
  "published": "2022-05-24T17:24:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15921"
    },
    {
      "type": "WEB",
      "url": "https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-11748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-02T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved as of device_manager 2.7.0.",
  "id": "GHSA-94hp-88qv-h74g",
  "modified": "2022-05-13T01:49:20Z",
  "published": "2022-05-13T01:49:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11748"
    },
    {
      "type": "WEB",
      "url": "https://puppet.com/security/cve/CVE-2018-11748"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "guzzlehttp/guzzle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-201",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:46:02Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn affected versions, the built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) put every first-class request header in cURL\u0027s origin header list (`CURLOPT_HTTPHEADER`). These handlers are the default when the PHP cURL extension is available. They move `Proxy-Authorization` to the proxy-only list (`CURLOPT_PROXYHEADER`) only when Guzzle predicts an HTTP or HTTPS proxy. A \"first-class\" header is part of the normal request message and can be set on a PSR-7 request, through client `headers` defaults, the `headers` request option, or middleware. It does not include a literal line supplied through raw `CURLOPT_HTTPHEADER`, `CURLOPT_PROXYHEADER`, or `stream_context.http.header` controls.\n\nBecause that migration follows Guzzle\u0027s prediction rather than the route libcurl actually takes, the credential stays in the origin list and is sent to the origin server when a request is:\n\n- direct, including `proxy` set to `\u0027\u0027` to disable proxying.\n- bypassed by a `no`, `no_proxy`, or `NO_PROXY` match.\n- sent through a SOCKS proxy, which does not use the HTTP proxy header channel.\n- redirected from a safely proxied hop into any of those routes: redirect middleware re-evaluates the proxy per hop but, unlike `Authorization` and `Cookie`, does not strip `Proxy-Authorization` cross-origin.\n\nOn installations whose libcurl is older than 7.37.0, or whose PHP cURL extension lacks `CURLOPT_PROXYHEADER`, `CURLOPT_HEADEROPT`, and `CURLHEADER_SEPARATE`, no proxy-only channel is available, so cURL left the header in the origin list for every route. The stream handler also serialized first-class values before selecting a proxy. PHP removes only the first `Proxy-Authorization` line from CONNECT, so another first-class value or a URL-userinfo Basic line could reach the tunneled origin. A later raw `stream_context.http.proxy` override could instead reroute either credential directly to the origin.\n\nThe disclosed value is a private credential meant only for the proxy. RFC 9110 defines `Proxy-Authorization` as credentials for the next inbound proxy, and an origin is never an intended recipient. The flaw can silently give a working proxy credential to an unrelated third party. In the worst case, an attacker controls the origin and records the credential through access logs, tracing systems, or application logs. If it remains valid, the attacker can abuse a paid or access-controlled proxy, impersonate the proxy principal, or reach destinations the proxy is trusted to reach. A strong remote exploit is possible when an application sends a request to an attacker-controlled HTTP URL through a proxy with a default `Proxy-Authorization` header, then follows the attacker\u0027s redirect to an HTTPS or no-proxy destination that Guzzle reaches directly.\n\nUsing a first-class `Proxy-Authorization` header is a legitimate, documented configuration, so affected applications are not misusing the library. Guzzle does not create this field, so applications that never configure one are unaffected by the first-class-header flaw. Proxy URL userinfo is not affected on its own, but the stream handler could expose its Basic line when combined with a first-class field or a later raw `stream_context.http.proxy` override. `CURLOPT_PROXYUSERPWD` is unaffected. Literal lines supplied through raw `CURLOPT_HTTPHEADER`, `CURLOPT_PROXYHEADER`, or `stream_context.http.header` remain caller-controlled and outside the first-class-header guarantee.\n\n### Patches\n\nThe issue is fixed in `7.14.2`. The cURL handlers keep first-class `Proxy-Authorization` values out of the origin header list. When proxy header separation is available, they pass the values through `CURLOPT_PROXYHEADER` with `CURLHEADER_SEPARATE`. An empty value uses cURL\u0027s semicolon form to suppress credentials from proxy URL userinfo. On older builds, Guzzle drops the field for direct, bypassed, and SOCKS routes, but fails before network I/O if the request might use an HTTP or HTTPS proxy.\n\nThe stream handler removes the field from origin headers before choosing a route. If it selects a proxy, it accepts one value, including empty, writes a validated proxy header, and gives that value precedence over proxy URL userinfo. Multiple values, line breaks, and raw proxy overrides that could reroute generated credentials fail before connection. Direct and bypassed requests drop the field. Versions before `7.14.2` are affected by these origin-bound credential paths.\n\n### Workarounds\n\nIf you cannot upgrade immediately, remove first-class `Proxy-Authorization` fields from requests, client defaults, and middleware. Supply proxy credentials instead through proxy URL userinfo, for example `http://user:pass@proxy.example:8080`, or use `CURLOPT_PROXYUSERPWD` with the cURL handlers. Do not combine proxy URL userinfo with a first-class field or a raw `stream_context.http.proxy` override. If a first-class field is unavoidable, use libcurl 7.37.0 or newer with `CURLOPT_PROXYHEADER`, `CURLOPT_HEADEROPT`, and `CURLHEADER_SEPARATE`, and ensure the field is never present on a client that can issue direct, bypassed, or SOCKS requests or follow redirects into those routes. A newer libcurl is necessary but does not fix Guzzle\u0027s route-dependent migration by itself, and disabling redirects reduces but does not eliminate exposure.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc9110.html#section-11.7.2\n* https://curl.se/libcurl/c/CURLOPT_PROXYHEADER.html\n* https://curl.se/libcurl/c/CURLOPT_HEADEROPT.html\n* https://curl.se/libcurl/c/CURLOPT_HTTPHEADER.html",
  "id": "GHSA-94pj-82f3-465w",
  "modified": "2026-08-04T12:49:56Z",
  "published": "2026-07-20T21:46:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67339"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/pull/3876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/commit/9e4580d4b9981e903dc6323fe37f50a96e85b05e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/guzzle/guzzle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/releases/tag/7.14.2"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Guzzle: Proxy-Authorization headers can be sent to origin servers"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:telegrambot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-03T19:35:07Z",
    "nvd_published_at": "2024-05-02T14:15:10Z",
    "severity": "LOW"
  },
  "details": "Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file `jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml` on the Jenkins controller as part of its configuration.\n\nThis token can be viewed by users with access to the Jenkins controller file system.\n\nAs of publication of this advisory, there is no fix.",
  "id": "GHSA-94pr-w968-h923",
  "modified": "2024-07-03T20:11:35Z",
  "published": "2024-05-02T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34147"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/telegram-notifications-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3294"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/05/02/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-23T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.",
  "id": "GHSA-9533-g28x-xwf2",
  "modified": "2022-03-30T00:01:10Z",
  "published": "2022-03-24T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0859"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10379"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-40655"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-24T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page",
  "id": "GHSA-95fh-63xw-wfh3",
  "modified": "2025-10-22T00:32:25Z",
  "published": "2022-05-24T19:15:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40655"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ilovewomen/D-LINK-DIR-605"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}