Information Disclosure

ibrnp.so is vulnerable to information disclosure. The vulnerability exists due to a lack of validated secret keys in stream-write.cpp which allows an attacker to gain access to sensitive information...

CVE-2023-26839

A cross-site request forgery CSRF vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site...

The Service Accounts Challenge: Can't See or Secure Them Until It's Too Late

Here's a hard question to answer: 'How many service accounts do you have in your environment?'. A harder one is: 'Do you know what these accounts are doing?'. And the hardest is probably: 'If any of your service account was compromised and used to access resources would you be able to detect and...

The vulnerability of the PostgreSQL database management system, related to the exposure of information, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PostgreSQL database management system is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a questionable string during the Kerberos session...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Desktop Client version 3.0.0 through versions prior to 3.6.5. An attacker could exploit the vulnerability to...

The vulnerability of the File Sharing component in the Nighthawk WiFi 6 Router (RAX30) microprogramming software allows a hacker to gain access to arbitrary files.

The vulnerability of the File Sharing component in the Nighthawk WiFi 6 Router RAX30 microprogramming software lies in insufficient access control. Exploiting this vulnerability can allow a remote attacker to gain access to arbitrary files...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura version 13.0 and earlier versions. An attacker could exploit the vulnerability to collect system logs...

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdmacm device node. While this access is unlikely to leak sensitive user information, it can be...

Juiker 信息泄露漏洞

Juiker is an instant messaging software for government and enterprise organizations from Juiker. An information disclosure vulnerability exists in Juiker version 4.6.0607.1, which originates from storing debug logs containing sensitive information to removable external storage. An attacker could...

CVE-2023-26864

SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent...

Osprey Pump Controller 命令注入漏洞

Osprey Pump Controller is a pump controller from Osprey. A security vulnerability exists in Osprey Pump Controller version 1.01 that stems from the presence of a command injection vulnerability. An attacker can exploit the vulnerability to gain access to the system...

PT-2023-13026

Name of the Vulnerable Software and Affected Versions tripleo-ansible affected versions not specified Description A flaw in the default configuration of tripleo-ansible allows a local attacker to potentially disclose important configuration details from an OpenStack deployment through brute force...

CVE-2023-1304 Rapid7 InsightCloudSec getattr() method access

An authenticated attacker can leverage an exposed getattr method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the...

CVE-2023-1314 Local Privilege Escalation Vulnerability in cloudflared's Installer

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

Path Traversal

swig-templates is vulnerable to Path Traversal. The vulnerability exists due to improper template restrictions which allows an attacker to access and read the files outside the restricted directory through the include or extends tags...

Information disclosure

An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions...

Information Disclosure

libmemcached.so is vulnerable to Information Disclosure. The vulnerability is due to a request timing out due to a low POLLTIMEOUT, but returns data for a previously requested key, which allows a remote attacker to gain access to unintended resources, resulting in disclosure of sensitive...

The vulnerability of the ColdFusion software platform, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform is related to insufficient protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2023-0346

Summary: CVE-2023-0346 affects Akuvox E11 cloud login via an unencrypted HTTP connection, enabling potential access to the Akuvox cloud and device if the MAC address is known. The issue is categorized as improper authentication (CWE-287) and is part of a broader set of vulnerabilities affecting A...

Akuvox E11 授权问题漏洞

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. The Akuvox E11 suffers from an authorization issue vulnerability that originates from performing a cloud login over an unencrypted HTTP connection. An attacker can access the Akuvox cloud and the device if...