CVE-2024-51989

The CVE-2024-51989 entry describes a cross-site scripting (XSS) vulnerability in PasswordPusher, affecting versions v1.41.1 through v1.48.0. The root cause is an unsanitized parameter that enables injection of malicious JavaScript. Affected deployments include self-hosted PasswordPusher installat...

CVE-2024-10469

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, roles, user type, license type,...

PYSEC-2024-196

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

Pomerium 安全漏洞

Pomerium is an open source identity-aware access agent from Pomerium, Inc. It is used to enable secure access to internal applications. A security vulnerability exists in versions prior to Pomerium v0.27.1 that stems from improper access to the Data Proxy API. An attacker could exploit the...

CVE-2024-46609

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords...

CVE-2024-47085

This vulnerability exists in Apex Softcell LD DP Back Office due to improper validation of certain parameters cCdslClicentcode and cLdClientCode in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to...

CVE-2024-25270

Mirapolis LMS 4.6.XX contains an IDOR vulnerability that authenticated users can exploit by manipulating the ID parameter and incrementing the STEP parameter, potentially exposing sensitive user data. Root cause: insecure direct object reference in the affected endpoint. Affected product/version:...

CVE-2024-4447

In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...

ZKTeco Central Control Attendance Machine Web Management Platform 安全漏洞

ZKTeco Central Control Attendance Machine Web Management Platform is a centralized control time and attendance machine web management platform from ZKTeco, China. A security vulnerability exists in Zkteco Central Control Attendance Machine Web Management Platform version v.3.0. An attacker can...

GHSA-HCF8-5J78-887V Apache StreamPark: Information leakage vulnerability

In Streampark version 2.1.4, when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. ...

CVE-2024-5483

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of getitemspermissionscheck function. This makes it possible for unauthenticated attackers to extract basic...

UBUNTU-CVE-2024-28188

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been...

CVE-2024-28188

The vulnerability CVE-2024-28188 affects the Jupyter Scheduler extension, where an unauthenticated API endpoint can expose the list of Conda environments for a server’s jupyter-scheduler users. Root cause: missing authentication on the runtime_environments endpoint in Jupyter Server. Impact: disc...

The vulnerability of the Contacts component in the macOS operating system, which allows a hacker to disclose protected information

The vulnerability of the Contacts component in the macOS operating system is related to the unencrypted storage of user data. Exploiting this vulnerability could allow an attacker to disclose the protected information...

PT-2024-18649 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Video Conferencing with Zoom plugin for WordPress versions up to and including 4.4.5 Description: The issue allows authenticated attackers with subscriber access or higher to expose sensitive information, including usernames, emails, and IDs ...

CVE-2023-44038

In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack...

VeridiumID 安全漏洞

VeridiumID is an integrated passwordless platform from VeridiumID. A security vulnerability exists in VeridiumID versions prior to 3.5.0. An attacker exploited the vulnerability to discover information about registered users via an LDAP injection attack...

ALLDATA 安全漏洞

ALLDATA is an online resource for automotive OEM information from ALLDATA, Inc. It provides diagnostic and repair information for vehicle manufacturers. A security vulnerability exists in ALLDATA version V0.4.6, which stems from vulnerability to unsecured privileges, where information about users...

PT-2024-18226 · WordPress · Terawallet

Name of the Vulnerable Software and Affected Versions: The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress versions up to, and including, 1.4.10 Description: The issue allows authenticated attackers with subscriber-level acce...