Fides Security Vulnerabilities

Fides is an open source privacy engineering platform for managing the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A security vulnerability exists in Fides versions prior to 2.37.0, which stems from the presence of an...

WordPress The Events Calendar PRO Plugin < 6.4.0.1 is vulnerable to Sensitive Data Exposure

Software The Events Calendar PRO Type Plugin Vulnerable versions 6.4.0.1 Fixed in 6.4.0.1 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-1295 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bc59557889e3 Credits Scott Kingsley Cla...

PT-2024-35422 · Jenkins · Jenkins Report Info Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Report Info Plugin versions 1.2 and earlier Description: The issue arises from the lack of path validation of the workspace directory while serving report files, leading to a path traversal vulnerability. This allows attackers with...

CVE-2024-2088

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxsgetExpSettings' function. This makes it possible for authenticated attackers, with subscriber access and above, to extract...

WordPress ApplyOnline plugin <= 2.6.2 - Missing Authorization to Sensitive Information Exposure vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability discovered by Lucio Sá in WordPress Plugin ApplyOnline versions = 2.6.2...

PT-2024-18791 · WordPress · Nextscripts: Social Networks Auto-Poster

Name of the Vulnerable Software and Affected Versions: NextScripts: Social Networks Auto-Poster plugin for WordPress versions up to, and including, 4.4.3 Description: The issue allows authenticated attackers with subscriber access and above to extract sensitive data, including social network API...

WordPress NextScripts Plugin <= 4.4.3 is vulnerable to Sensitive Data Exposure

Software NextScripts Type Plugin Vulnerable versions = 4.4.3 Fixed in 4.4.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2088 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3f1f558bcdc3 Credits Colin Xu Required privilege...

UBUNTU-CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

WordPress Debug Log – Manger Tool plugin <= 1.4.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by emad Patchstack Alliance in WordPress Plugin Debug Log – Manger Tool versions = 1.4.5...

WordPress Debug Log – Manger Tool Plugin <= 1.4.5 is vulnerable to Sensitive Data Exposure

Software Debug Log – Manger Tool Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-34798 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 669450ad8391 Credits emad Required...

CVE-2023-33321 WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure

Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6...

Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0

Summary On Windows systems, the Arc configuration files resulted to be world-readable. Impact This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files. Mitigation N/A Solution Upgrade to v1.6.0 or later...

Improper Input Validation

Overview Microsoft.PowerBI.JavaScript is a suite of JavaScript web components for integrating Power BI into your app. Affected versions of this package are vulnerable to Improper Input Validation via the client-side data handling process. An attacker can expose sensitive information by intercepti...

CVE-2024-33004

SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on...

WordPress Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhammad Daffa Patchstack Alliance in WordPress Plugin Contact Form Widget versions = 1.3.9...

WordPress Contact Form Widget Plugin <= 1.3.9 is vulnerable to Sensitive Data Exposure

Software Contact Form Widget Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2024-34754 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d1ef53f8459c Credits Muhammad Daffa Required...

Lobe Chat Security Vulnerability

Lobe Chat is an open source, high performance chatbot framework. A security vulnerability exists in Lobe Chat versions prior to 0.150.6, which stems from an unauthorized server-side request forgery vulnerability that allows an attacker to construct a malicious request without logging in, resultin...

Siemens RUGGEDCOM CROSSBOW SQL注入漏洞

Siemens RUGGEDCOM CROSSBOW is a proven secure access management solution from Siemens, Germany. Siemens RUGGEDCOM CROSSBOW suffers from a SQL injection vulnerability due to a failure of an affected client system to properly filter input data before sending it to the SQL server. An attacker could...

CVE-2024-32100 WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11...

CVE-2024-32100 WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11...