NewsFortinet PSIRT
Credential disclosure in LDAP configuration web page.
Teaser from the source
CVSSv3 Score: 2.5 An Insufficiently protected credentials vulnerability [CWE-522] in FortiSanbox and FortiSanbox PaaS GUI may allow an authenticated administrator to read LDAP server credentials via client-side inspection. Revised on 2026-04-14 00:00:00
This is the RSS-feed teaser. Read the full article at the original source.
Read at Fortinet PSIRTMore on configuration
Other advisories
- MediumCVE-2026-119560OPNsense: Configuration line injection via multiple GUI text fields
- Not ratedosv:CVE-2026-97350Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows
- Not ratedosv:CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
- MediumCVE-2026-93008Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
- Not ratedosv:CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
- Not ratedosv:CLEANSTART-2026-DV70438Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
- Not ratedosv:CLEANSTART-2023-WM40998combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files
- Not ratedosv:CLEANSTART-2023-FP61791Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1
Other news entries
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switchesNewsBleepingComputer
- Who approves the files that control your AI coding assistant?NewsCSO Online
- bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificatesBreachpwn.watch
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth WeaknessesNewsThe Hacker News
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineNewsThe Hacker News
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposedBreachpwn.watch
- Hackers hijack AOMEI update servers to secretly spread malwareNewsBleepingComputer
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-113
ID