CVE-2021-20556 IBM Cognos Controller information disclosure

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181...

Google protobuf 安全漏洞

Google protobuf is a data exchange format from Google, Inc. A security vulnerability exists in Google protobuf, which stems from a security issue in the C++ JSON parser that, under certain circumstances, could cause the parser to copy freed data into an error message with malicious JSON input...

Mattermost Information Disclosure Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from an inability to remove detailed error messages from API requests. An attacker could exploit this vulnerability to obtain...

shim: Out-of-bounds read printing error messages

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a cras...

GHSA-VX97-8Q8Q-QGQ5 Mattermost's detailed error messages reveal the full file path

Mattermost versions 9.6.x = 9.6.0, 9.5.x = 9.5.2, 9.4.x = 9.4.4 and 8.1.x = 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored...

Mattermost's detailed error messages reveal the full file path

Mattermost versions 9.6.x = 9.6.0, 9.5.x = 9.5.2, 9.4.x = 9.4.4 and 8.1.x = 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored...

CVE-2024-32046 Detailed error discloses full file path with dev mode off

Mattermost versions 9.6.x = 9.6.0, 9.5.x = 9.5.2, 9.4.x = 9.4.4 and 8.1.x = 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored...

CVE-2024-32046 Detailed error discloses full file path with dev mode off

Mattermost versions 9.6.x = 9.6.0, 9.5.x = 9.5.2, 9.4.x = 9.4.4 and 8.1.x = 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from an inability to remove detailed error messages from API requests. An attacker could exploit this vulnerability to obtain...

OpenClinic GA 5.247.01 - Information Disclosure Vulnerability

Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Link: https://sourceforge.net/projects/open-clinic/ Version: OpenClinic GA 5.247.01 Tested on: Windows 10, Windows 11 CVE: CVE-2023-40278 Details An Information...

OpenClinic GA 5.247.01 - Information Disclosure

Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure Date: 2023-08-14 Exploit Author: VB Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Link: https://sourceforge.net/projects/open-clinic/ Version: OpenClinic GA 5.247.01 Tested on: Windows 10, Windows 11 CVE:...

Concrete CMS 9.2.7 Cross Site Scripting / Open Redirect

Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 Date: 4/2024 Exploit Author: Andrey Stoykov Version: 9.2.7 Tested on: Ubuntu 22.04 Blog: http://msecureltd.blogspot.com Verbose Error Message - Stack Trace: 1. Directly browse to edit profile page 2. Error should come up with verbose stack...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in its ability to disclose information through a server error message, allowing an intruder to expose the protected information.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the disclosure of information through a server error message. Exploiting this vulnerability allows an attacker to remotely disclose the protected information...

CVE-2023-6877

CVE-2023-6877 affects RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for WordPress. It permits Stored Cross-Site Scripting via the plugin’s shortcode error messages (Content-Type) when retrieving an invalid RSS feed. Varies versions up to 4.3.3 are af...

CVE-2024-25695

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-25695

CVE-2024-25695 affects Esri Portal for ArcGIS (versions 11.2 and below). It is a Cross-site Scripting vulnerability where input is not properly sanitized and rendered in error messages; no privileges are required and the attack can be executed by a remote, authenticated attacker. Public reference...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to execute this attack...

PT-2024-21093 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions prior to 11.2 Description: The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error...

The vulnerability of the Google Sheets platform for monitoring and observation by Grafana involves the generation of error messages containing confidential information, which allows attackers to gain access to confidential data.

The vulnerability of the Google Sheets platform for monitoring and observation by Grafana involves improper handling of error messages, which potentially exposes key Google Sheets API details. Exploiting this vulnerability could allow an attacker to gain access to confidential data remotely...