CWE-522 vulnerabilities

CVE-2025-15622 is a medium severity vulnerability in Sparx Systems Pty Ltd. 's Sparx Enterprise Architect version 16.1.1627. The vulnerability involves insufficient protection of OAuth2 client credentials, where the desktop client reveals the plaintext OAuth2 client secret. This secret is decoded and used in the OpenID authentication flow to exchange for access and ID tokens. There is no official patch or remediation level currently provided by the vendor, and no known exploits in the wild have been reported.

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) allows an attacker to modify the server's configuration file, potentially leading to mass data exfiltration, malicious traffic interception, or disruption of testing services.

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

CVE-2026-35185 is a high-severity improper access control vulnerability in haxtheweb's HAXiam product prior to version 25.0.0. The /server-status endpoint is publicly accessible without authentication, exposing sensitive information such as authentication tokens, user activity, client IP addresses, and server configuration details. This exposure allows unauthenticated users to monitor real-time user interactions and gather internal infrastructure information. The vulnerability is fixed in version 25.0.0.

CVE-2026-35467 is a high-severity vulnerability in the CERT/CC cveClient/encrypt-storage.js component where API keys stored in the temporary browser client are insufficiently protected. The encryption credentials are not properly marked as protected, which could allow extraction through JavaScript console access or other errors. This vulnerability has a CVSS score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2(v4.10.1).

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g.redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis.

IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently protected credentials.

CVE-2025-64998 is a high-severity vulnerability in Checkmk versions prior to 2.4.0p23, 2.3.0p45, and 2.2.0 that allows a remote site administrator with config sync enabled to hijack sessions on the central site by forging session cookies. This occurs due to exposure of the session signing secret, which is insufficiently protected. Exploitation requires high privileges on a remote site and involves partial user interaction. The vulnerability impacts confidentiality, integrity, and availability of the central site sessions.

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.