11799 matches found
GitLab 10.2 < 13.3.9 / 13.4 < 13.4.5 / 13.5 < 13.5.2 (CVE-2020-13352)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: =10.2, =13.4, =13.5, =10.2, =13.4, =13.5,...
CVE-2023-38420
Intel Power Gadget for macOS (all versions) is affected by CVE-2023-38420 due to an improper conditions check in the software, allowing an authenticated local user to potentially disclose information. The NVD/Intel advisory lists the affected scope and notes a Product Discontinuation Notice with ...
PT-2024-13237 · Intel · Intel Power Gadget
Name of the Vulnerable Software and Affected Versions: IntelR Power Gadget software for Windows affected versions not specified Description: The issue is related to improper initialization in the IntelR Power Gadget software, which may allow an authenticated user to potentially enable denial of...
Debug Info <= 1.3.10 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Debug Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
The vulnerability of the Linux operating system’s Network File System kernel allows a hacker to cause a service failure.
The vulnerability of the Linux operating system’s Network File System kernel lies in the lack of protection against unauthorized data processing during the execution of the .GETDEVICEINFO and LAYOUTGET operations in UDP packets. Exploiting this vulnerability can allow an attacker to cause service...
goreleaser shows environment by default
Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...
GHSA-F6MM-5FC7-3G3C goreleaser shows environment by default
Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...
CVE-2023-5937
CVE-2023-5937 affects Arc before version 1.6.0 on Windows, where configuration files are world-readable, enabling local information disclosure. Multiple sources describe this as a local-access risk that could exfiltrate sensitive data from Arc’s configuration files. The issue is linked to Arc’s W...
PT-2024-26320 · Idccms · Idccms
Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/homePro deal.php" with parameters mudi, dataType, and dataTypeCN. This issue allows for unauthorized requests. Recommendations: F...
PT-2024-40776 · Libvpx · Libvpx
Name of the Vulnerable Software and Affected Versions: libvpx affected versions not specified Description: The issue is related to a crash caused by a use-of-uninitialized-value error. The crash occurs in the vpx codec peek stream info function, as reported by the OSS-Fuzz tool. Recommendations: ...
PT-2024-4724 · Ооо 'Кейсистемс' · Сервис Оправдательных Документов
Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names. It may allow a remote attacker to gain read access to local files. Recommendations: At the...
CVE-2024-21823
Hardware logic with insecure de-synchronization in IntelR DSA and IntelR IAA for some IntelR 4th or 5th generation XeonR processors may allow an authorized user to potentially enable escalation of privilege local access...
CVE-2024-30043
CVE-2024-30043 affects Microsoft SharePoint Server (on-premises) and is caused by improper restriction of XML External Entity (XXE) references, enabling information disclosure. Public details include an XXE exploit example for SharePoint Server 2019 and related advisories. Affected product/versio...
CVE-2023-50180
An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other...
HDF Group HDF5 安全漏洞
HDF Group HDF5 is a suite of tools for managing and storing different types of data from the American company HDF Group. The product supports managing, manipulating, viewing and analyzing data and generating files in portable formats. A security vulnerability exists in HDF5 version 1.14.3 and pri...
RHEL 6 : perl-image-info (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - perl-Image-Info: XXE in SVG files CVE-2016-9181 Note that Nessus has not tested for this issue but has instead reli...
Linksys E5600 Command Injection Vulnerability
Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in the Linksys E5600 v1.1.0.26, which stems from the failure of the PinCode parameter of the /API/info form endpoint to properly filter constructed command special characters...
Europol Hacked? IntelBroker Claims Major Law Enforcement Breach
By Waqas Notorious hacker IntelBroker claims a major data breach at Europol. Allegedly, sensitive data including employee info, source code, and operational documents were compromised. Europol has yet to confirm the breach. Could this expose ongoing investigations and endanger law enforcement...