CVE-2024-23287

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. An app may be able to access user-sensitive data...

Apple macOS Sonoma Security Vulnerability

Apple macOS Sonoma is a desktop operating system from the U.S.-based Apple Inc. A security vulnerability exists in Apple macOS Sonoma version 14.4, which originates from a malicious application that may be able to observe user data in log entries related to accessibility notifications...

CVE-2024-27356

An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user information. This affects MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300,...

CVE-2024-0595

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpasgetusers function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with...

CVE-2023-28900

Summary (CVE-2023-28900) : The Skoda Automotive cloud backend (Skoda Connect service) is affected by a Broken Access Control vulnerability that allows disclosure of nicknames and other user identifiers by supplying an arbitrary vehicle VIN number. The root cause is improper access control on the ...

CVE-2023-49098

CVE-2023-49098 affects the Discourse-Reactions plugin for Discourse. Data about a user’s reaction notifications could be exposed; this was mitigated by patch commit 2c26939. The CVSSv3.1 base metrics from the record are: AV:N/AC:L/PR:L/UI:R/S:U, Confidentiality Impact: Low, Integrity/Availability...

PT-2024-15065 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.8 Description: The issue allows authenticated attackers with contributor access and above to extract sensitive data, including user emails, password hashes, and usernames, via th...

CVE-2023-50342

HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference IDOR vulnerability. A user can obtain certain details about another user as a result of improper access control...

Apple macOS Ventura Security Vulnerability

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.6.3, which stems from an application that may be able to access protected user data...

The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring lies in improper restrictions on path names in the catalog. This allows attackers to disclose user information, obtain login credentials in plain text, or perform NTLM relay attacks.

The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to disclose user information, obtain login credentials in...

CVE-2023-47279

In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying...

Delta Electronics InfraSuite Device Master Security Vulnerability

Delta Electronics InfraSuite Device Master is a device for simplifying and automating critical device monitoring from Delta Electronics, Taiwan, China. A security vulnerability exists in Delta Electronics InfraSuite Device Master version v.1.0.7, which originated from a vulnerability that could...

Mozilla: WebExtensions could open arbitrary URLs

The Mozilla Foundation Security Advisory describes this flaw as: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

Torchbox Wagtail Log Information Disclosure Vulnerability

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Wagtail that originates from a user with a Wagtail Administrator Limited Privilege Editor account that can retrieve any user's display name...

PT-2023-32984 · Moq · Moq

Name of the Vulnerable Software and Affected Versions: Moq versions 4.20.0-rc through 4.20.1 Description: The issue concerns the inclusion of SponsorLink in certain versions of Moq, which runs an obfuscated DLL at build time. This DLL scans local git config data and shares the user's hashed email...

Incorrect Authorization

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Incorrect Authorization through the authorization mechanism. A low-privileged attacker could access other users' data without requiring user...

Ivanti Releases Security Updates for Endpoint Manager Mobile (EPMM) CVE-2023-35078

A vulnerability discovered in Ivanti Endpoint Manager Mobile EPMM, previously branded MobileIron Core allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information PII such as names, phone numbers, and other mobile...

CVE-2023-2959

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Oliva Expertise EKS: before 1.2...

UBUNTU-CVE-2023-34106

GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should...

PT-2023-24677 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.68 through 10.0.7 Description: The issue is related to an incorrect rights check on a file accessible by an authenticated user, allowing access to the list of all users and their personal information. Users should upgrade to...