29755 matches found
microcode_ctl: Exposure of sensitive information
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
The Unusual Suspect: Git Repos
While phishing and ransomware dominate headlines, another critical risk quietly persists across most enterprises: exposed Git repositories leaking sensitive data. A risk that silently creates shadow access into core systems Git is the backbone of modern software development, hosting millions of...
hibernate-validator: Hibernate Validator Expression Language Injection
A flaw was found in Hibernate Validator. This vulnerability allows unauthorized access to sensitive information or the execution of arbitrary Java code by interpolating user-supplied input in a constraint violation message with an Expression Language...
CVE-2025-7380
CVE-2025-7380 is a stored XSS in ADM Access Control. The vulnerability allows injecting unsanitized scripts into the folder name field during shared folder creation, which execute in the user UI and may access session cookies or other data. Affected: ADM 4.1.0–4.3.3.RH61 and ADM 5.0.0.RIN1 and ea...
CVE-2024-38648
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...
PT-2025-29527 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.9 Description: Directus is a real-time API and App dashboard for managing SQL database content. When using Directus Flows with the WebHook trigger, all incoming request details, including security-sensitiv...
PT-2025-29520 · Dokploy · Dokploy
Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.24.3 Description: Dokploy is a free, self-hostable Platform as a Service PaaS. A vulnerability in the preview deployment feature allows any user to execute arbitrary code and access sensitive environment variables ...
PT-2025-29526 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0 through 11.8.9 Description: Directus is a real-time API and App dashboard for managing SQL database content. When using Directus Flows to handle CRUD events for users, the "Log to Console" operation with a template...
The vulnerability of the Storage Port Driver driver for the Microsoft Windows operating system, which allows a hacker to disclose protected information
The vulnerability of the Microsoft Windows operating system’s Storage Port Driver relates to operations that exceed the buffer limits in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...
Directus 日志信息泄露漏洞
Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. A logging information disclosure vulnerability exists in Directus versions prior to 9.0.0 through 11.9.0, which stems from logging sensitive data and could lead to data...
PT-2025-29914 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A SQL Injection vulnerability exists due to manipulation of SQL queries through the id funcionario parameter of the /html/saude/profile paciente.php endpoint,...
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the raft server protocol. An attacker can access sensitive server resources, including directories and files, by sending unauthenticated requests. Remediatio...
CVE-2025-5040
A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...
CVE-2020-36848
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to...
CVE-2024-38648
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...
CVE-2024-38648
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...
CVE-2024-38648
Summary: CVE-2024-38648 is a vulnerability in Ivanti Desktop and Server Management (Ivanti DSM) prior to version 2024.2. It arises from a hardcoded secret that could allow an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Affected products/ver...
PT-2025-29292 · Ivanti · Ivanti Dsm
Name of the Vulnerable Software and Affected Versions: Ivanti DSM versions prior to 2024.2 Description: A hardcoded secret within the software allows an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Recommendations: Update Ivanti DSM to versi...
WordPress Order Delivery Date Pro for WooCommerce plugin < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure vulnerability
Unauthenticated Arbitrary Post Title Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.6.0...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via a two-step extraction process involving a crafted symlink and a subsequent archive containing a relative path that targets a critical file. An attacker can overwrite files outside the intended extraction director...