Active Directory credential disclosure via unchecked registration

Information disclosure in FOG Server 1.5.10.41.2 allows remote attackers to obtain configured Active Directory credentials during host registration. The manual-registration path applies the server's default Active Directory domain, username, and password to an unauthenticated host without checking whether that host is authorized to receive an image task. Network access to registration is sufficient; the disclosed service account can expose the joined Active Directory environment, while registration also creates a host record.