Missing Authorization

Overview typo3/cms-recordlist is a Lists database records in the TYPO3 backend module WebList. Affected versions of this package are vulnerable to Missing Authorization for the CSV download process. An attacker can access sensitive information from arbitrary database tables in the user's web...

GHSA-W2PF-7Q5W-2CGW TYPO3 Workspaces Module Information Disclosure

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access...

TYPO3 CMS exposes sensitive information in an error message

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations...

CVE-2025-59018

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access...

CVE-2025-40804

A vulnerability has been identified in SIMATIC Virtualization as a Service SIVaaS All versions. The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization...

CVE-2025-40803

The CVE-2025-40803 affects Siemens/RUGGEDCOM RST2428P (6GK6242-6PA00) across all versions, exposing certain non-critical device information that could allow an unauthenticated attacker to access sensitive data and breach confidentiality. Connected sources (Tenable OT plugin, NVD, Red Hat, CNNVD, ...

Microsoft OfficePlus Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-42926

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42958 Missing Authentication check in SAP NetWeaver

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the...

Microsoft SQL Server 竞争条件问题漏洞

Microsoft SQL Server is a large commercial database system from Microsoft Corporation that is used under Microsoft Windows. A competitive condition issue vulnerability exists in Microsoft SQL Server. An attacker exploiting this vulnerability could gain access to sensitive information. The followi...

Siemens RUGGEDCOM RST2428P 信息泄露漏洞

The Siemens RUGGEDCOM RST2428P is a server communication device from Siemens Germany. An information disclosure vulnerability exists in the Siemens RUGGEDCOM RST2428P, which arises from the device exposing non-critical information that could lead to the disclosure of sensitive data...

Microsoft Windows Kernel 信息泄露漏洞

Microsoft Windows Kernel is the kernel of the Windows operating system from Microsoft Corporation USA. An information disclosure vulnerability exists in Microsoft Windows Kernel. An attacker could exploit this vulnerability to obtain sensitive information. The following products and versions are...

CVE-2025-29089

An issue in TP-Link AX10 Ax1500 v.1.3.10 Build 20230130 allows a remote attacker to obtain sensitive information...

PT-2025-36734

Name of the Vulnerable Software and Affected Versions: APTIOV affected versions not specified Description: APTIOV contains vulnerabilities in the BIOS that could allow a privileged user to cause a “Write-what-where Condition” and “Exposure of Sensitive Information to an Unauthorized Actor” throug...

Google Android Information Disclosure Vulnerability (CNVD-2025-21349)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2025-0011

Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality...

CVE-2025-41708

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41708

CVE-2025-41708 involves cleartext transmission due to an insecure default configuration that uses HTTP for the web interface. An unauthenticated attacker on the same network could learn sensitive data during transmission. Connected documents reference affected products (e.g., Bender devices) but ...

CVE-2025-41708 Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41708 Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...