VikBooking Hotel Booking Engine & PMS < 1.5.4 - Booking Data Disclosure

The plugin has guessable booking IDs, which could allow attackers to retrieve booking data via an IDOR in the search request...

CVE-2022-27849

Sensitive Information Disclosure sac-export.csv in Simple Ajax Chat WordPress plugin = 20220115...

Yokogawa Electric CENTUM VP 授权问题漏洞

The Yokogawa Electric CENTUM VP is a CENTUM distributed control system from Yokogawa Electric. Setting high standards for engineering and technical excellence while ensuring backward compatibility with previous system versions and support for the latest technology applications. A security...

The vulnerability of the Webservices Manager component of the Oracle Communications Billing and Revenue Management software lies in insufficient validation of input data. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Webservices Manager component of the Oracle Communications Billing and Revenue Management software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility o...

The vulnerability of the Core component of the VirtualBox virtualization software allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Core component of the VirtualBox virtualization software is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the SSL/TLS SSLWolf library, related to information disclosure due to incompatibilities, allows attackers to gain access to confidential data.

The vulnerability of the SSL/TLS library WolfSSL is related to the use of Base64 decoding functions with non-persistent execution time. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

The vulnerability of the decoder in the MPEG-4 multimedia platform GPAC’s functional decoding process allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the CTS decoder used in MPEG-4 multimedia platform GPAC is related to incorrect checking of the result of an arithmetic operation. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the microprogrammed software of the MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ programmable logic controllers lies in the use of a password hash instead of a plain text password for authentication. This allows attackers to disclose sensitive information or compromise data integrity.

The vulnerability of the microprogrammed logic controllers MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ lies in the use of a password hash instead of a plain password for authentication. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive...

CVE-2022-22565

CVE-2022-22565 affects Dell PowerScale OneFS 9.0.0–9.3.0. The issue is an improper authorization of an index containing sensitive information, allowing an authenticated privileged user to disclose or modify sensitive data. The vulnerable component is associated with the OneFS operating system’s i...

CVE-2022-22541

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access...

CVE-2022-22541

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational or OLAP connections. The main impact is the disclosure of company data to people that shouldn't or don't need to have access...

CVE-2022-22541

Technical details beyond the SAP BusinessObjects disclosure description are not provided in the connected documents. No explicit root cause, affected components, or mitigations are listed. Monitor for updates and official advisories.

USN-5371-1 nginx vulnerabilities

It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2020-11724 It was discovered that nginx Lua module mishandled certain input...

PT-2022-2597

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description The issue is related to errors in security settings, allowing an attacker to bypass security features and potentially disclose protected information. A security-feature bypass...

PT-2022-2926 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to a lack of protection for sensitive data in the Windows Graphics Component, which can be exploited to disclose protected information. This can allo...

PT-2022-18952 · Bentley · Microstation Connect

Name of the Vulnerable Software and Affected Versions: Bentley MicroStation CONNECT version 10.16.02.034 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open ...

PT-2022-2668 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to errors in processing information in the Windows Hyper-V hardware virtualization system, which can allow a remote attacker to gain unauthorized access to...

CVE-2022-0920 Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data...

CVE-2022-0919 Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...

多款 MediaTek 产品安全漏洞

MediaTek chips are a variety of chips from MediaTek, a division of China's MediaTek Mediatek. A security vulnerability exists in various MediaTek products that stems from incorrect error handling in atf hwfde, which may disclose sensitive information...