CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3827

CVE-2018-3827 is an information disclosure flaw in the Elasticsearch repository-azure plugin (formerly elasticsearch-cloud-azure). When the repository-azure plugin runs with logging set to TRACE, Azure credentials can be written to logs, exposing sensitive data. Several connected sources confirm ...

CVE-2018-16710

OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the...

CVE-2018-5005

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2018-15684

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory /include/logs using predictable file names, which can lead to full path disclosure and leakage of sensitive data...

FreeBSD : Gitlab -- multiple vulnerabilities (ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd)

Gitlab reports : Persistent XSS in Pipeline Tooltip GitLab.com GCP Endpoints Exposure Persistent XSS in Merge Request Changes View Sensitive Data Disclosure in Sidekiq Logs Missing CSRF in System Hooks Orphaned Upload Files Exposure Missing Authorization Control API Repository Storage C Tenable...

CVE-2018-12806

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

Elasticsearch ESA-2018-11

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. C Tenable Network Security, Inc. include"compat.inc"; if...

Adobe Experience Manager server-side request forgery vulnerability (CNVD-2018-14949)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2018-12809

Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2016-10533

CVE-2016-10533 affects express-restify-mongoose. Vulnerable versions (2.4.2 and earlier, and 3.0.X through 3.0.1) allow a malicious user to abuse GET /User?distinct=password to retrieve all user passwords, bypassing private field protections. The root cause is information leakage through listing/...

Werewolf Online 0.8.8 - Information Disclosure

Werewolf Online 0.8.8 - Information Disclosure Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link:...

Citrix XenMobile Server Sensitive Data Disclosure Vulnerability

Citrix XenMobile Server is a mobility management solution from Citrix Systems. The solution is capable of managing mobile devices, developing mobile policies and compliance rules, and providing insight into the operation of mobile mobile networks. A security vulnerability exists in Citrix XenMobi...

MakeMyTrip application for Android information disclosure vulnerability

MakeMyTrip application for Android is an Android based application for booking tickets, hotels and cabs. A security vulnerability exists in version 7.2.4 of the MakeMyTrip application for Android-based platforms, which stems from the program's failure to encrypt a locally stored database. An...

CVE-2018-11242

An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases locally stored are not encrypted and have cleartext that might lead to sensitive information disclosure, as demonstrated by data/com.makemytrip/databases and data/com.makemytrip/Cache SQLite database files...

Foxit Reader Information Disclosure Vulnerability (CNVD-2018-11861)

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. An out-of-bounds read vulnerability exists in the U3D Texture Image Format object in Foxit Reader version 9.0.0.29935, where the program fails to properly validate user-submitted data. The vulnerability can be...

CVE-2018-9980

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A privilege-lifting vulnerability exists in Microsoft Exchange Server 2016 Cumulative Update versions 8 and 9, which stems...

PT-2018-3407 · Dovecot +3 · Dovecot +3

Name of the Vulnerable Software and Affected Versions: Dovecot affected versions not specified Description: The issue is related to an out of bounds read that can be triggered by a specially crafted email message delivered over SMTP and passed on to Dovecot by MTA. This can result in potential...

The vulnerability of the DNS server dnsmasq, related to deficiencies in handling redirected DHCPv6 requests, allows a hacker to disclose sensitive information that should be protected.

The vulnerability of the DNS server dnsmasq is related to deficiencies in the handling of redirected DHCPv6 requests. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by introducing special elements into the command...