CVE-2022-46163 travel-support-program vulnerable to data exfiltration via Ransack query injection

Travel support program is a rails app to support the travel support program of openSUSE TSP. Sensitive user data bank account details, password Hash can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The...

CVE-2022-46163 travel-support-program vulnerable to data exfiltration via Ransack query injection

Travel support program is a rails app to support the travel support program of openSUSE TSP. Sensitive user data bank account details, password Hash can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The...

CVE-2022-46163

CVE-2022-46163 affects the Travel Support Program (openSUSE) – a Rails app that uses the Ransack search library. The default Ransack configuration can be abused via *_start, *_end, or *_cont matchers to perform character‑by‑character brute‑force and exfiltrate sensitive data (e.g., bank account n...

Apple iOS 安全漏洞

Apple iOS is a set of operating systems developed for mobile devices by the American company Apple. A security vulnerability exists in Apple iOS version 16. An attacker exploiting this vulnerability could access sensitive user data...

Apple watchOS 安全漏洞

Apple watchOS is an operating system for smartwatches from Apple. A security vulnerability exists in Apple watchOS. An attacker could exploit this vulnerability to gain access to sensitive user information...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS has a security vulnerability that originates from an application that may be able to access sensitive user data...

RelatedChat 安全漏洞

RelatedChat is an open source alternative communication platform for Related Code individual developers. A security vulnerability exists in RelatedChat. An attacker exploiting this vulnerability could access sensitive data of any user of the application...

CVE-2022-32849

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to access sensitive user information...

CVE-2022-33003

The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

PYSEC-2022-218

The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

Zibal 安全漏洞

Zibal is the Zibal payment gateway. A security vulnerability exists in Zibal. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

AAmiles 安全漏洞

AAmiles is a machine learning project scanner. AAmiles suffers from a security vulnerability. An attacker exploited the vulnerability to access sensitive user information and digital currency keys, as well as to elevate privileges...

KGExplore 安全漏洞

KGExplore is a publicly available knowledge graph exploration project for individual developers. A security vulnerability exists in the KGExplore package for PyPI versions v0.1.1 through v0.1.2. An attacker exploited the vulnerability to access sensitive user information and digital currency keys...

IBM Robotic Process Automation 信息泄露漏洞

IBM Robotic Process Automation is a robotic process automation product from IBM USA. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation suffers from an information disclosure vulnerability that stems from...

PT-2022-18018 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 Description: The issue concerns the handling of environment variables, which has been addressed with improved validation. A user may be able to view sensitive user information due to this issue. Recommendations: F...

ImpressCMS 授权问题漏洞

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to an access control error that could be exploited by remote attackers to bypass implemented security restrictions and obtain...

PT-2022-16769

Name of the Vulnerable Software and Affected Versions Open Web Analytics versions prior to 1.7.4 Description The issue allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files...

CVE-2022-20680

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive dat...

Improper Authentication in liukuo362573/yishaadmin

Description Hi there yishaadmin maintainer, I would like to report an improper authentication vulnerability in yishaadmin source code. The link /admin/OrganizationManage/User/GetFormJson?id=user-id does not require any authentication and return sensitive user data for anyone like username, gender...

PT-2021-15571 · Rexroth +1 · Indramotion Mlc L20 +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue involves information disclosure where the main configuration, including users and their hashed passwords, is exposed through an unprotected web server resource. This...