DBSyncer 安全漏洞

DBSyncer is an open source data synchronization middleware by 86dbs individual developers. A security vulnerability exists in DBSyncer version v2.0.6, which stems from improper access control of the /config/download component and could lead to the disclosure of sensitive information...

IBM Business Automation Workflow 访问控制错误漏洞

IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. An access control error vulnerability exists in IB...

HashiCorp Vault Enterprise和HashiCorp Vault Community 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community are both products of HashiCorp, Inc. of the U.S. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault Community is a key management engine. HashiCorp Vault Community is a key management engine used to...

PT-2025-18390 · Elastic · Apm Server

Name of the Vulnerable Software and Affected Versions: Elasticsearch APM Server affected versions not specified Description: The issue concerns the potential disclosure of sensitive information in APM Server error logs. This could happen when a bulk index request partially fails, causing parts of...

Rail Pass Management System /admin/search-pass.php File SQL Injection Vulnerability

Rail Pass Management System is a rail pass management system. The Rail Pass Management System suffers from a SQL injection vulnerability that occurs when the searchdata parameter in the /admin/search-pass.php file is not properly filtered. An attacker can exploit this vulnerability to obtain...

Docker Desktop 安全漏洞

Docker Desktop is a desktop software for lightweight deployment of applications based on container technology from Docker Inc. in the United States. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...

USN-7446-1 libapache2-mod-auth-openidc vulnerability

It was discovered that modauthopenidc incorrectly handled certain POST requests. An attacker could possibly use this issue to obtain sensitive information...

T-INNOVA Deporsite 安全漏洞

T-INNOVA Deporsite is an application from T-INNOVA. A security vulnerability exists in T-INNOVA Deporsite that stems from improper handling of the idUsuario parameter in the /helper/Familia/obtenerFamiliaUsuario endpoint, which could lead to the disclosure of sensitive information...

Dell PowerScale OneFS 安全漏洞

PowerScale OneFS is a distributed storage operating system developed by Dell to provide unified file system management and high availability services for enterprise-class storage environments. Dell PowerScale OneFS suffers from an authorization logic error vulnerability that stems from not proper...

CVE-2025-25002

Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network...

CVE-2025-30302 Adobe Framemaker | Out-of-bounds Read (CWE-125)

Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in tha...

PT-2025-15491 · Microsoft · Azure Local Cluster

Name of the Vulnerable Software and Affected Versions: Azure Local Cluster affected versions not specified Description: The issue allows an authorized attacker to disclose sensitive information over an adjacent network by inserting it into a log file in an Azure Local Cluster. This can potentiall...

CVE-2025-30224

MyDumper is a MySQL Logical Backup Tool. The MySQL C client library libmysqlclient allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients connect to untrusted...

CVE-2023-37405 IBM Cloud Pak System information disclosure

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user...

WordPress NP Quote Request for WooCommerce plugin <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Tim Coen in WordPress Plugin NP Quote Request for WooCommerce versions = 1.9.179...

Danswer 访问控制错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An Access Control Error vulnerability exists in Danswer v1.4.1, which stems from a misconfiguration of CORS and could lead to the disclosure of sensitive information...

feast 访问控制错误漏洞

feast is an AI/ML open source function library from Feast Open Source. An access control error vulnerability exists in feast version 0.40.0, which stems from a misconfiguration of CORS and could lead to the disclosure of sensitive information...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS that originates from sending information without using HTTPS...

CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)

Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...