Delinea Secret Server 10.9.000002
Approved changes feed: RSS · Atom
cpe:2.3:a:delinea:secret_server:10.9.000002:*:*:*:*:*:*:*
part: a version: 10.9.000002 update: *
| Vendor | Delinea (c1fd2206-04f3-5726-8f1a-a84dd6dd15d5) |
|---|---|
| Product | Secret Server (7be34212-5b4e-5914-b0f3-d282d8cfbfa4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-33891 |
vulnerable | 2026-06-08 06:37:32.247245 |
Details available
HIGH (8.8)
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.
Published: 2024-04-28T00:00:00.000Z
Updated: 2025-02-12T14:59:33.572Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4589 |
vulnerable | 2026-06-08 06:16:13.511491 |
Insufficient verification of data authenticity vulnerability in Delinea Secret Server
CRITICAL (9.1)
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the update process lacks digital signatures and fails to validate the integrity of the update package, allowing the attacker to inject malicious applications during the update.
Published: 2023-09-06T11:48:59.706Z
Updated: 2024-09-26T17:56:10.176Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4588 |
vulnerable | 2026-06-08 06:16:13.510165 |
File accessibility vulnerability in Delinea Secret Server
MEDIUM (6.8)
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Exploitation of this vulnerability could allow an authenticated user with administrative privileges to create a backup file in the application's webroot directory, changing the default backup directory to the wwwroot folder, and download it with some configuration files such as encryption.config/ and database.config stored in the wwwroot directory, exposing the database credentials in plain text.
Published: 2023-09-06T11:43:19.278Z
Updated: 2024-09-06T14:12:59.302Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.