Exposure of Sensitive Information Through Metadata

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata due to an issue in proxyserver.py. An attacker can obtain sensitive information, including API keys, by triggering error...

CVE-2025-0503

Mattermost 9.11.x

CVE-2024-53866 pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data including on first...

CVE-2024-34152 Playbook Run Metadata leak to Guest

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server...

CVE-2024-34152 Playbook Run Metadata leak to Guest

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server...

CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2023-25819 Discourse tags with no visibility are leaking into og:article:tag

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...

CVE-2023-25819 Discourse tags with no visibility are leaking into og:article:tag

Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...

Design/Logic Flaw

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page...

OPENSUSE-SU-2019:0050-1 Security update for aria2

This update for aria2 fixes the following security issue: - CVE-2019-3500: Metadata and potential password leaks via --log= boo1120488...

GLSA-201903-08 : GNU Wget: Password and metadata leak

The remote host is affected by the vulnerability described in GLSA-201903-08 GNU Wget: Password and metadata leak A vulnerability was discovered in GNU Wgets filemetadata in xattr.c. Impact : A local attacker could obtain sensitive information to include credentials. Workaround : There is no know...

CVE-2006-6016

CVE-2006-6016 affects WordPress components prior to 2.0.5. A remote authenticated user can access the metadata of arbitrary users by modifying the user_id parameter on wp-admin/user-edit.php. The underlying issue exposes partial confidentiality and is triggered by insufficient access control for ...

GLSA-200409-35 : Subversion: Metadata information leak

The remote host is affected by the vulnerability described in GLSA-200409-35 Subversion: Metadata information leak There is a bug in modauthzsvn that causes it to reveal logged metadata regarding commits to protected areas. Impact : Protected files themselves will not be revealed, but an attacker...

Subversion: Metadata information leak

Background Subversion is a versioning system designed to be a replacement for CVS. modauthzsvn is an Apache module to do path-based authentication for Subversion repositories. Description There is a bug in modauthzsvn that causes it to reveal logged metadata regarding commits to protected areas...