Monthly
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
LDAP credential exposure in Snipe-IT 8.6.2 and earlier lets an on-path attacker capture service-account and end-user passwords in cleartext. Ldap::connectToLdap() called ldap_start_tls() and discarded the boolean result, so when TLS negotiation fails or a man-in-the-middle answers the StartTLS extended request with a 'Protocol error', the subsequent ldap_bind() sends credentials unencrypted while users see a normal, silent login. Only deployments with LDAP authentication enabled and TLS configured (ldap_enabled=1, ldap_tls=1) plus an attacker-reachable network path to the LDAP server are exposed; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor advisory publishes the exact code path and trigger.
SiYuan 3.6.0 through 3.8.6 accepts and persists the networkServeTLS administrator setting but never enforces it, so the kernel port continues answering plain HTTP with full API access in cleartext while also serving HTTPS on the same port. An operator who enables the toggle believes kernel traffic is encrypted, yet a network-adjacent attacker can sniff the login flow - including the access auth code - and the session cookie, which is issued without the Secure attribute while HTTPS responses omit HSTS, allowing session hijack against the kernel API. Exploitation requires a network-adjacent sniffing position and the operator having enabled the setting, which is why the flaw is rated for adjacency and high complexity rather than internet-wide exposure; a public PoC reference exists describing the verification steps, and it is not confirmed as working exploit code. A vendor fix is available in v3.8.7.
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.
Cleartext transmission of Amazon S3 credentials and data in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows a network-positioned attacker to intercept sensitive information when S3 integration is left on default transport settings. Exploitation is unauthenticated but requires the S3 feature to be in use, the default cleartext transport to be unchanged, and an on-path man-in-the-middle position; deployments using TLS, VPC endpoints, or VPNs are not at risk. No public exploit code has been identified at time of analysis, and our assessment rates this as AC:H rather than AC:L due to these prerequisites.
Cleartext transmission of certain cluster-management communications in Progress MarkLogic Server 12.x releases before 12.1.0 allows an on-path attacker to read and modify inter-node management data, compromising both confidentiality and integrity of cluster operations. The vendor CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): exploitation requires no authentication and no user interaction, but the attacker must already occupy a man-in-the-middle position on the network segment carrying MarkLogic cluster traffic, which in well-segmented environments is a trusted internal VLAN not reachable from general user networks - realistically limiting exposure to insiders or attackers who have already achieved lateral movement. Availability is unaffected, and no public exploit identified at time of analysis.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
Cross-host request replay in AsyncHttpClient (AHC) before 3.0.13 and 2.16.1 can disclose the original origin's request path, Host header, Authorization credentials, or even a plaintext request to a completely different destination when an application's ResponseFilter fails over or retries a request onto a different base origin (host, scheme, or port) or downgrades HTTPS to HTTP. The assessed vector is unauthenticated from the network perspective (PR:N, AV:N), but exploitation hinges on a concrete application-side prerequisite: a ResponseFilter (or equivalent retry/failover code path) that replays requests across origins - default AHC usage with same-host retries is unaffected, and AC:H/AT:P reflect the specific sequencing that must occur. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the impact depends on configuration rather than an attacker-reachable endpoint, the CVSS 4.0 score of 9.4 and the independent CVSS 3.1 assessment point in different directions; prioritization should be driven by whether a cross-host replaying filter is deployed.
Cleartext credential disclosure in AsyncHttpClient (AHC) before 3.0.12 on the 3.x line and before 2.16.1 on the 2.x line causes a client configured to use an HTTP proxy to write the origin request and its Authorization credentials onto a still-plaintext proxy connection when the proxy rejects the CONNECT with anything other than 200, because the client infers an established tunnel from the last request method rather than the CONNECT result. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH), this is an unauthenticated, confidentiality-only issue: Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. Exploitation is limited to environments where the victim application routes through an HTTP proxy and the attacker controls or can man-in-the-middle the client-to-proxy hop; no public exploit identified at time of analysis.
Unauthenticated screen-content disclosure in WolfVision Cynap Pro and Cynap Core Pro devices with vSolution Matrix enabled lets hosts on the same network segment view or capture the current presentation through an unencrypted RTSP/RTP stream. The issue affects versions below 1.78a and is limited to confidentiality; the vendor has released 1.78a, and no public exploit was identified at time of analysis. Exposure is bounded by the non-default Matrix feature requirement and network adjacency.
LDAP credential exposure in Snipe-IT 8.6.2 and earlier lets an on-path attacker capture service-account and end-user passwords in cleartext. Ldap::connectToLdap() called ldap_start_tls() and discarded the boolean result, so when TLS negotiation fails or a man-in-the-middle answers the StartTLS extended request with a 'Protocol error', the subsequent ldap_bind() sends credentials unencrypted while users see a normal, silent login. Only deployments with LDAP authentication enabled and TLS configured (ldap_enabled=1, ldap_tls=1) plus an attacker-reachable network path to the LDAP server are exposed; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor advisory publishes the exact code path and trigger.
SiYuan 3.6.0 through 3.8.6 accepts and persists the networkServeTLS administrator setting but never enforces it, so the kernel port continues answering plain HTTP with full API access in cleartext while also serving HTTPS on the same port. An operator who enables the toggle believes kernel traffic is encrypted, yet a network-adjacent attacker can sniff the login flow - including the access auth code - and the session cookie, which is issued without the Secure attribute while HTTPS responses omit HSTS, allowing session hijack against the kernel API. Exploitation requires a network-adjacent sniffing position and the operator having enabled the setting, which is why the flaw is rated for adjacency and high complexity rather than internet-wide exposure; a public PoC reference exists describing the verification steps, and it is not confirmed as working exploit code. A vendor fix is available in v3.8.7.
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.
Autodesk's ADP Desktop SDK transmits sensitive Autodesk service credentials and tokens over an unencrypted channel (CWE-319), allowing anyone able to observe that traffic to capture the secrets and use them for unauthorized access to Autodesk services. The published CVSS 3.1 vector (7.5) is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, which describes a constrained scenario - local positioning, high attack complexity, some existing privileges, and a legitimate user triggering the SDK operation - while our independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) models an on-path observer on an adjacent network with confidentiality-only impact; either reading requires the attacker to already be positioned to observe the cleartext transmission. Exploitation is limited to loss of confidentiality of transmitted secrets, not code execution or integrity compromise, and there is no public exploit identified at time of analysis; a vendor patch is available per the Autodesk advisory.
Cleartext transmission of Amazon S3 credentials and data in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows a network-positioned attacker to intercept sensitive information when S3 integration is left on default transport settings. Exploitation is unauthenticated but requires the S3 feature to be in use, the default cleartext transport to be unchanged, and an on-path man-in-the-middle position; deployments using TLS, VPC endpoints, or VPNs are not at risk. No public exploit code has been identified at time of analysis, and our assessment rates this as AC:H rather than AC:L due to these prerequisites.
Cleartext transmission of certain cluster-management communications in Progress MarkLogic Server 12.x releases before 12.1.0 allows an on-path attacker to read and modify inter-node management data, compromising both confidentiality and integrity of cluster operations. The vendor CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): exploitation requires no authentication and no user interaction, but the attacker must already occupy a man-in-the-middle position on the network segment carrying MarkLogic cluster traffic, which in well-segmented environments is a trusted internal VLAN not reachable from general user networks - realistically limiting exposure to insiders or attackers who have already achieved lateral movement. Availability is unaffected, and no public exploit identified at time of analysis.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
Cross-host request replay in AsyncHttpClient (AHC) before 3.0.13 and 2.16.1 can disclose the original origin's request path, Host header, Authorization credentials, or even a plaintext request to a completely different destination when an application's ResponseFilter fails over or retries a request onto a different base origin (host, scheme, or port) or downgrades HTTPS to HTTP. The assessed vector is unauthenticated from the network perspective (PR:N, AV:N), but exploitation hinges on a concrete application-side prerequisite: a ResponseFilter (or equivalent retry/failover code path) that replays requests across origins - default AHC usage with same-host retries is unaffected, and AC:H/AT:P reflect the specific sequencing that must occur. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the impact depends on configuration rather than an attacker-reachable endpoint, the CVSS 4.0 score of 9.4 and the independent CVSS 3.1 assessment point in different directions; prioritization should be driven by whether a cross-host replaying filter is deployed.
Cleartext credential disclosure in AsyncHttpClient (AHC) before 3.0.12 on the 3.x line and before 2.16.1 on the 2.x line causes a client configured to use an HTTP proxy to write the origin request and its Authorization credentials onto a still-plaintext proxy connection when the proxy rejects the CONNECT with anything other than 200, because the client infers an established tunnel from the last request method rather than the CONNECT result. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH), this is an unauthenticated, confidentiality-only issue: Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. Exploitation is limited to environments where the victim application routes through an HTTP proxy and the attacker controls or can man-in-the-middle the client-to-proxy hop; no public exploit identified at time of analysis.