CVE-2024-28971

The CVE-2024-28971 entry corresponds to Dell Update Manager Plugin versions 1.4.0–1.5.0, with a plain-text password storage vulnerability in the log file that could lead to disclosure of user credentials. Multiple connected sources confirm the issue and potential credential exposure; exploitation...

The vulnerability of the QTS and QuTS operating systems’ network storage solutions from QNAP allows a hacker to execute arbitrary code.

The vulnerability of QTS and QuTS network storage systems from QNAP lies in the fact that the operation occurs outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-29052

Windows Storage Elevation of Privilege Vulnerability...

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

BIT-MINIO-2022-35919 Authenticated requests for server update admin API allows path traversal in minio

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow...

CVE-2024-26144

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain...

WordPress Plugin Admin side data storage for Contact Form 7 SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

The vulnerability of the RGWPostObj_ObjStore_S3::get_params() function (rgw_rest_s3.cc) in the RGW storage service of the Ceph system allows a attacker to circumvent security restrictions and upload arbitrary files.

The vulnerability of the RGWPostObjObjStoreS3::getparams function rgwrests3.cc in the RGW storage service of the Ceph system is related to deficiencies in access control when processing bucket keys. Exploiting this vulnerability allows an attacker to bypass security restrictions and upload...

CVE-2023-45998

kodbox 1.44 is vulnerable to Cross Site Scripting XSS. Customizing global HTML results in storing XSS...

Directory traversal

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request...

The vulnerability of the Photos storage system in operating systems such as tvOS, iOS, iPadOS, and watchOS allows attackers to gain access to photographs stored in the temporary catalog.

The vulnerability of Photos storage in operating systems such as tvOS, iOS, iPadOS, and watchOS is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to photos stored in the temporary catalog...

Code injection

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality...

SUSE-SU-2023:3822-1 Security update for supportutils

This update for supportutils fixes the following issues: Security fixes: - CVE-2022-45154: Removed iSCSI passwords bsc1207598. Other Fixes: - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory bsc1210950 + A Cleartext Storage of Sensitive Information vulnerability...

TerraMaster NAS 注入漏洞

TerraMaster is a world-renowned professional storage brand. TerraMasterTOS command injection vulnerability can be exploited by attackers to gain server privileges...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. An authentication error vulnerability exists in the...

CVE-2023-26204

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate...

CVE-2023-26204

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate...

The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to execute arbitrary code.

The vulnerability of cloud-based software for creating and using Nextcloud data storage solutions is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system remotely...

CVE-2023-28808

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices...

CVE-2023-25059 WordPress avalex Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin = 3.0.3 versions...