Secret Server
Approved changes feed: RSS · Atom
cpe:2.3:a:delinea:secret_server:*:*:*:*:on-premises:*:*:*
part: a version: * update: *
| Vendor | Delinea (c1fd2206-04f3-5726-8f1a-a84dd6dd15d5) |
|---|---|
| Product | Secret Server (7be34212-5b4e-5914-b0f3-d282d8cfbfa4) |
| Edition | * |
| Language | * |
| Software edition | on-premises |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6943 |
vulnerable | 2026-06-08 07:43:16.681639 |
Details available
LOW (3.8)
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
Published: 2025-07-02T15:45:01.702Z
Updated: 2025-07-02T15:59:43.816Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-33891 |
vulnerable | 2026-06-08 06:37:32.248851 |
Details available
HIGH (8.8)
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.
Published: 2024-04-28T00:00:00.000Z
Updated: 2025-02-12T14:59:33.572Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12908 |
vulnerable | 2026-06-08 06:25:36.315847 |
Details available
MEDIUM (6.9)
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfully exploited, a remote attacker may be able to convince a user to visit a malicious web-page, or open a
malicious document which could trigger the vulnerable handler, allowing them to execute
arbitrary code on the user's machine. Delinea added additional validation that the downloaded installer's batch file was in the expected format.
Published: 2024-12-26T15:45:39.592Z
Updated: 2024-12-27T14:22:58.318Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.