2622 matches found
CVE-2024-56968
An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload...
CVE-2024-56953
An issue in Baidu China Co Ltd Baidu Input Method iOS version v12.6.13 allows attackers to access user information via supplying a crafted link...
PT-2025-3356 · Baidu · Baidu Lite
Name of the Vulnerable Software and Affected Versions: Baidu Lite version 6.40.0 Description: The issue allows attackers to access user information by supplying a crafted link. Recommendations: For version 6.40.0, consider avoiding the use of links from untrusted sources until a patch is availabl...
CVE-2024-56969
BeautyPlus for iOS 7.8.010 is affected by a vulnerability that allows an attacker to access sensitive user information by supplying a crafted link. Affected software: BeautyPlus iOS app (version 7.8.010). Root cause details are not provided in the supplied documents. Impact: exposure of confident...
CVE-2024-56972
An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link...
CVE-2024-56972
CVE-2024-56972 concerns Midea Home for iOS version 9.3.12. The available documents describe a vulnerability that allows an attacker to access sensitive user information by supplying a crafted link. No concrete exploit details are provided in the sources. Some entries note that there is no informa...
CVE-2024-56960
CVE-2024-56960 affects Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings on iOS, version 1.3.50. The issue allows attackers to access sensitive user information by supplying a crafted link. Connected sources corroborate the basic description across multiple feeds (e.g., Red Hat, NVD, ...
CVE-2024-56964
An issue in Che Hao Duo Used Automobile Agency Beijing Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link...
CVE-2024-56964
CVE-2024-56964 affects Guazi Used Car iOS 10.15.1. The connected sources indicate that an attacker can access sensitive user information by supplying a crafted link, implying a vulnerability in how links trigger data exposure. The base CVSS metrics in the Initial document show a Medium severity (...
CVE-2025-24363 The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and...
Broken Object Level Authorization
Indico is vulnerable to a Broken Object Level Authorization BOLA vulnerability. The vulnerability is due to insufficient access control in the /api/principals component, which allows attackers to retrieve information about other user accounts by sending crafted POST requests...
CVE-2024-56924
CVE-2024-56924 affects Code Astro Internet Banking System 2.0.0. The vulnerability is a Cross Site Request Forgery (CSRF) that can allow remote attackers to have an authenticated admin execute arbitrary JavaScript on the admin page (pages_account), potentially changing account settings or exfiltr...
BIT-PHP-MIN-2024-5458 Filter bypass in filter_var (FILTER_VALIDATE_URL)
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as filtervar when validating URLs FILTERVALIDATEURL for certain types of URLs the function will result in invalid user information username + password part of URLs being...
MAL-2025-191770 Malicious code in just-framework (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 95cb11d9c49d15c2a3d932930ab9d4f1567e118bf2ed951ab313856878f88859 Importing the module exfiltrates basic information using DNS queries. There is no other purpose of the package. --- Category: PROBABLYPENTEST - Packages lookin...
Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location
A hack of location data company Gravy Analytics has revealed which apps are—knowingly or not—being used to collect your information behind the scenes...
CGA-6C24-W5J3-9HF7
Bulletin has no description...
Insecure Direct Object Reference (IDOR)
oqtane.framework is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient authorization checks in the Oqtane.Controllers.UserController, allows attackers to manipulate the id parameter to access sensitive information belonging to other users...
Moodle < 4.1.15, 4.3.x < 4.3.9, 4.4.x < 4.4.5, 4.5.x < 4.5.1 Multiple Vulnerabilities
Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...