CVE-2021-3155

snapd 2.54.2 and earlier created /snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1...

CVE-2019-4351

CVE-2019-4351 affects IBM Maximo Anywhere 7.6.4.0, where the application could disclose sensitive information to a user with physical access due to how usernames are stored in local storage (directory names for user attachments). The issue is a local-access information disclosure vulnerability (n...

CVE-2022-23197 Adobe Illustrator Out-of-bounds Read could lead to Memory leak

Adobe Illustrator versions 25.4.3 and earlier and 26.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...

PT-2022-10716 · Siemens +1 · Siemens Jt2Go +1

Name of the Vulnerable Software and Affected Versions: Datalogics APDFL library affected versions not specified Siemens JT2Go affected versions not specified Description: The issue is related to a memory corruption condition that occurs while parsing specially crafted PDF files. This could allow ...

PT-2022-6343 · Microsoft · 365 Apps +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps affected versions not specified Description: The issue is related to a buffer overflow in memory, allowing an attacker to disclose protected information using a specially...

Incorrect Authorization in Drupal core

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed...

PT-2022-8503 · Drupal · Drupal Quickedit Module

Name of the Vulnerable Software and Affected Versions: Drupal QuickEdit module affected versions not specified Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the...

Microweber 操作系统命令注入漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A command injection vulnerability exists in Microweber, which stems from the failure of the...

PT-2022-10939 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12 Description: The issue concerns a misleading message in the "Clear storage" functionality, potentially leading to local information disclosure without requiring additional execution privileges...

Deserialization of Untrusted Data in bson

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure...

GHSA-4JWP-VFVF-657P Deserialization of Untrusted Data in bson

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure...

CVE-2021-33166

Incorrect default permissions for the IntelR RXT for Chromebook application, all versions, may allow an authenticated user to potentially enable information disclosure via local access...

PT-2022-15510 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Workplace Server versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787 Description: The issue allows an attacker to execute crafted database queries, potentially exposing the backend database. Successf...

MediaTek 芯片缓冲区错误漏洞

MediaTek chips are a variety of chips from MediaTek, a division of China's MediaTek Mediatek. A security vulnerability exists in the MediaTek chips that stems from incorrect boundary checking in the cmdq driver, which may result in out-of-bounds reads. This could lead to the disclosure of local...

microweber 安全漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A security vulnerability exists in microweber, which stems from the inclusion of sensitive...

PT-2022-1660 · Microsoft · Windows Common Log File System Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Common Log File System Driver affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to disclose protected information. It enables attackers to obtain sensitive informati...

CVE-2022-0474

Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions...

Rockwell Automation Micrologix Improper Access Control (CVE-2017-14462)

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

The vulnerability of PDF files created by AcroForms, a text viewing program called Foxit Reader, and the PDF editing program Foxit PhantomPDF, allowing attackers to disclose protected information.

The vulnerability of PDF files created by AcroForms, as well as the Foxit Reader and Foxit PhantomPDF programs used for PDF editing, is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...