PT-2024-34: Server Side Request Forgery (SSRF) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...

WordPress Keep Backup Daily Plugin <= 2.1.0 is vulnerable to Sensitive Data Exposure

Software Keep Backup Daily Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A8: Software and Data Integrity Failures Classification Sensitive Data Exposure CVE CVE-2024-48024 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 104015a1054b Credits Joshua Chan...

CVE-2024-33506

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain ADOM to access device summary of unauthorized ADOMs via crafted HTTP...

CVE-2024-47344 WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through = 2.1.5...

CVE-2024-47344 WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StylemixThemes uListing.This issue affects uListing: from n/a through 2.1.5...

PT-2024-32559 · Ulisting · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing versions 2.1.5 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access to it...

CVE-2024-38040

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files...

PT-2024-32850 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: Mediawiki - PageTriage versions 1.39.X through 1.39.8 Mediawiki - PageTriage versions 1.41.X through 1.41.2 Mediawiki - PageTriage versions 1.42.X through 1.42.1 Description: The issue affects the Mediawiki - PageTriage extension, allowing...

The vulnerability of the Next.js software platform for creating web applications lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

Finrota Netahsilat 安全漏洞

Finrota Netahsilat is an online collection system and e-collection program from Finrota, Inc. A security vulnerability exists in Finrota Netahsilat that stems from allowing the extraction of embedded sensitive data...

CVE-2024-7315 Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups...

CVE-2024-7315 Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups...

PYSEC-2024-186

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

Advantech ADAM-5630 Information Disclosure Vulnerability

Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech, China. The Advantech ADAM-5630 suffers from an information disclosure vulnerability that is caused by a flaw in sharing user credentials in plain text. An attacker can exploit the vulnerability to obtain...

CVE-2024-46471

The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information...

WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin uListing versions = 2.1.5...

WordPress AI ChatBot with ChatGPT and Content Generator by AYS Plugin <= 2.0.9 is vulnerable to Sensitive Data Exposure

Software AI ChatBot with ChatGPT and Content Generator by AYS Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.1.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2024-7713 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 5f8161e14afa Credi...

WordPress uListing Plugin <= 2.1.5 is vulnerable to Sensitive Data Exposure

Software uListing Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-47344 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ae4f1f1d6d26 Credits Joshua Chan Required privilege...

Improper Privilege Management

org.apache.hadoop,hadoop-common is vulnerable to Improper Privilege Managements. The vulnerability is due to the RunJar.run method not setting permissions for the temporary directory by default, which allows other local users to view sensitive data stored in that directory...

PT-2024-24273 · Ibm · Ibm Cognos Command Center

Name of the Vulnerable Software and Affected Versions: IBM Cognos Command Center versions 10.2.4.1 through 10.2.5 Description: The issue could disclose highly sensitive user information to an authenticated user with physical access to the device. Recommendations: For versions 10.2.4.1 and 10.2.5,...