GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...

SQL Injection Vulnerability in Normandy Technology Website Building System

Zhongshan Normandy Information Technology Co., Ltd. is a service organization that provides network informatization for enterprises and institutions. Normandy Technology website building system has SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information in...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2019-22627)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. Mozilla Firefox suffers from an information disclosure vulnerability that can be...

USN-4049-1 glib2.0 vulnerability

It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this issue to access sensitive information...

SQL Injection Vulnerability in the Website Building System of Beijing Transcend Infinite Information Technology Co.

Beijing Beyond Infinity Information Technology is a company engaged in website construction. A SQL injection vulnerability exists in the website building system of Beijing Beyond Unlimited Information Technology Co. Attackers can utilize the vulnerability to obtain sensitive information of the...

SQL Injection Vulnerability in the Report Query System of Health Management Center

Beijing Standardsoft Information Technology Co., Ltd. is a professional medical checkup software provider, focusing on creating highly intelligent medical checkup management software. Health management center report query system has sql injection vulnerability, attackers can use the vulnerability...

Arbitrary File Read Vulnerability in Zhiyuan OA-A8 System

Zhiyuan OA-A8 system is an office system developed by Beijing Zhiyuan Xiechuang Software Co. Zhiyuan OA-A8 system has an arbitrary file read vulnerability, which can be exploited by attackers to obtain sensitive information...

Information leakage vulnerability in VTS management system

Shenzhen Yingzhijie Network Technology Co., Ltd. is a subsidiary of Intex Group, which is committed to providing valuable product services for enterprises. Information leakage vulnerability exists in VTS management system. Attackers can utilize the vulnerability to obtain sensitive information...

SQL Injection Vulnerability in Purple File Management System

Purple Software Systems Ltd. is a software services and systems integration provider. A SQL injection vulnerability exists in the Purple File Management System, which can be exploited by attackers to obtain sensitive information from the database...

Design/Logic Flaw

IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 158400...

Adobe Campaign Classic Information Disclosure Vulnerability (CNVD-2019-18621)

Adobe Campaign Classic ACC is a suite of cross-channel customer experience marketing platforms from the American company Audobee Adobe. The platform features real-time interaction management, Adobe Experience Cloud integration, data management and integration. An information disclosure...

Python Information Disclosure Vulnerability (CNVD-2019-17319)

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. An information disclosure vulnerability exists in Python. The vulnerability stems from errors such as...

Magic Point Access Control and Time Attendance has an override access vulnerability

Hangzhou Magic Point Technology Co., Ltd. is a technology-based enterprise combining artificial intelligence technology and industry applications, focusing on face recognition technology scenario-based applications and solutions. Magic Point Access Control Attendance has an override access...

IBM Maximo Asset Management Information Disclosure Vulnerability (CNVD-2019-44945)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. An information...

Sensitive Data Exposure in sequelize-cli

Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...

GHSA-3XC7-XG67-PW99 Sensitive Data Exposure in sequelize-cli

Versions of sequelize-cli prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text. Recommendation Upgrade to version 5.5.0 or later...

PT-2019-19997

Name of the Vulnerable Software and Affected Versions sequelize-cli versions prior to 5.5.0 Description The issue concerns Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value, which may cause passwords with special characters to be logged in plai...

UBUNTU-CVE-2019-12210

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debugfile, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it...

Sensitive Data Exposure in pem

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used. The readPkcs12 function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in...

PT-2019-20062

Name of the Vulnerable Software and Affected Versions pem versions prior to 1.13.2 Description The issue exposes sensitive data when the readPkcs12 function is used. This function reads certificate and key data from a pkcs12 file using the encryption password, creating a globally readable file wi...