https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 09:32:34 +0000 https://cve.radiocsirt.org/vuln/cve-2023-33187 <p><strong>Affected:</strong> highlight</p> <p>Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type=&#34;text&#34;` via a javascript &#34;Show Password&#34; button. This differs from the expected behavior which always obfuscates `type=&#34;password&#34;` inputs. A customer may assume that switching to `type=&#34;text&#34;` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type=&#34;password&#34;` continues to be obfuscated.</p> <p><strong>Affected:</strong> highlight</p> <p>Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type=&#34;text&#34;` via a javascript &#34;Show Password&#34; button. This differs from the expected behavior which always obfuscates `type=&#34;password&#34;` inputs. A customer may assume that switching to `type=&#34;text&#34;` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type=&#34;password&#34;` continues to be obfuscated.</p> https://cve.radiocsirt.org/vuln/cve-2023-33187