> CVE-2026-3277

« BACK_TO_HOME
PUBLISHED
2026-02-27 16:16
MODIFIED
2026-02-27 16:16
EPSS (Prob. Exploit)
0.22%
Top 87.9%
DATA SOURCES:
NVD 🔗 2026-02-27 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-312

> CWE DETAILED DESCRIPTIONS

CWE-312: Cleartext Storage of Sensitive Information - The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

> GITHUB SECURITY ADVISORY

GHSA-9437-39hj-3c93 MODERATE

Apache Spark History Server allows stored cross-site scripting through unescaped application names

AFFECTED PACKAGES:
MAVEN / org.apache.spark:spark-core_2.13
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8
MAVEN / org.apache.spark:spark-core_2.12
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8
PIP / pyspark
>= 3.0.0, < 3.5.8
Fixed in: 3.5.8

> HISTORIQUE DES MODIFICATIONS

Première apparition
27/02/2026 16:16
Source: NVD
📊 ENRICHISSEMENT 01/03/2026 06:46
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-312: Cleartext Storage of Sensitive Information - The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Total des modifications: 1 Dernière mise à jour: 8 months ago

> REFERENCES

https://devolutions.net/security/advisories/DEVO-2026-0006
« BACK_TO_HOME