PT-2024-39154 · Mercury · Mercury Mnvr816

Name of the Vulnerable Software and Affected Versions: Mercury MNVR816 versions up to 2.0.1.0.5 Description: A vulnerability has been found that allows for files or directories to be made accessible. The issue affects an unknown part of the file /web-static/. It is possible to initiate the attack...

PT-2024-38647 · WordPress · Pixelyoursite Pro +1

Name of the Vulnerable Software and Affected Versions: PixelYourSite – Your smart PIXEL TAG & API Manager versions up to and including 9.7.1 PixelYourSite PRO versions up to and including 10.4.2 Description: The vulnerability allows unauthenticated attackers to view potentially sensitive...

Supermicro Onboard IPMI Port 49152 Sensitive File Exposure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule 'Supermicro Onboard IPMI Port 49152 Sensitive File Exposure', 'Description' = %q This module abuses a file exposure vulnerability...

CVE-2024-41699

Priority – CWE-552: Files or Directories Accessible to External Parties...

Priority 安全漏洞

Priority is an ERP solution from Priority Israel. Priority has a security vulnerability that originates from a file or directory that is accessible to external parties...

PT-2024-7410 · Siemens · Scalance Mum856-1 +13

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions V8.1 RUGGEDCOM RM1224 LTE4G NAM versions V8.1 SCALANCE M804PB versions V8.1 SCALANCE M812-1 ADSL-Router family versions V8.1 SCALANCE M816-1 ADSL-Router family versions V8.1 SCALANCE M826-2 SHDSL-Router...

PT-2024-29384 · Dzzoffice · Dzzoffice

Name of the Vulnerable Software and Affected Versions: dzzoffice version 2.02.1 Description: The issue allows for Directory Traversal via the user/space/about.php endpoint. This means an attacker could potentially access files outside the intended directory structure by manipulating the input to...

CVE-2024-38321

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868...

PT-2024-27942 · Ibm · Ibm Business Automation Workflow

Name of the Vulnerable Software and Affected Versions: IBM Business Automation Workflow versions 22.0.2 through 24.0.0 Description: The issue concerns the storage of potentially sensitive information in log files under certain situations, which could be read by an authenticated user. This may lea...

The vulnerability of the web interface of IP-telephone devices, BAS-IP, allows a perpetrator to disclose protected information.

The vulnerability of the web interface of IP-telephone devices BAS-IP relates to the storage of user credentials in configuration files. Exploiting this vulnerability can allow an attacker to disclose sensitive information by sending a specially crafted HTTP request...

CVE-2024-6317

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.0.6. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...

UBUNTU-CVE-2024-32498

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to...

AZL-42904 CVE-2024-6104 affecting package keda for versions less than 2.14.0-2

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

CVE-2022-44587

Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3...

WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability

Sensitive Data Exposure via Log File vulnerability discovered by Snicco Patchstack Alliance in WordPress Plugin WP 2FA versions = 2.6.3...

CVE-2024-5557

CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the controller logs...

PT-2024-13698 · Precor · Precor Touchscreen Console

Name of the Vulnerable Software and Affected Versions: Precor touchscreen console versions P62, P80, and P82 Description: The issue allows a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obta...

CVE-2024-2360

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute...

CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute...

CVE-2024-2360

CVE-2024-2360 affects parisneo/lollms-webui. The vulnerability is a path traversal flaw due to insufficient sanitization of user-supplied input in the settings for the Database path and PDF LaTeX path , allowing an attacker to traverse directories and potentially execute arbitrary code on the tar...