CVE-2024-39328

Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role Config Admin could exceed their configuration privileges in a multi-partition environment and access some confidential data. Data integrity and availability is not at risk...

CVE-2024-39328

Atos Eviden IDRA and IDCA prior to version 2.7.0 expose an insecure permissions issue where a Config Admin (highly trusted role) could exceed configuration privileges in a multi‑partition environment and access confidential data. Impact cites data confidentiality only; integrity/availability not ...

SAP NetWeaver AS Java Multiple Vulnerabilities (Feb 2025)

SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities, including the following: - The User Admin application of SAP NetWeaver AS for Java insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This resul...

The vulnerability of the Security component of the MacOS operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Security component of the MacOS operating system is related to the insecure storage of confidential information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Keyboard Event Handler component in MacOS operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Keyboard Event Handler component in MacOS operating systems is related to state management errors. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information...

The vulnerability of the Login Window component in operating systems running on macOS allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Login Window component in operating systems running macOS is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

Vulnerability of the Server component: Security: Privileges of the MySQL Server database management system, which allows attackers to gain unauthorized access to confidential information.

The vulnerability of the MySQL Server component’s Security: Privileges section is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential information...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, which allows a hacker to access confidential information

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity is related to incorrect authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to access confidential information...

The vulnerability of the distributed Git version control system, related to the lack of mechanisms for encoding or shielding output data, allows a hacker to disclose protected information.

The vulnerability of the distributed Git version control system is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data...

CVE-2020-8481

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody...

CVE-2024-21079

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Campaign LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attac...

CVE-2024-21167

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite component: Party Search UI. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trading Community...

CVE-2024-1708

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems...

The vulnerability of the Diff module in the Drupal system, related to incorrect authentication procedures, allows attackers to access confidential information.

The vulnerability of the Diff module in the Drupal system is related to incorrect authentication procedures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information...

The vulnerability of the gst_wavparse_cue_chunk function in the Gstreamer multimedia framework, which allows a hacker to access confidential information

The vulnerability of the gstwavparsecuechunk function in the Gstreamer multimedia framework relates to reading data outside of the allowed range by the WAV parser. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information...

The vulnerability of the extract_cc_from_data function in the Gstreamer multimedia framework, which allows a hacker to gain access to confidential information

The vulnerability of the extractccfromdata function in the Gstreamer multimedia framework is related to reading beyond the allowed range. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

The vulnerability of the Drupal CMS system’s Image Sizes module, related to the insertion of confidential information into the transmitted data, allows attackers to circumvent security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Image Sizes module in Drupal systems is related to the insertion of confidential information into the transmitted data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

PT-2025-5279 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.3 Description: The issue is related to the insecure storage of confidential information in the Messages component of the MacOs operating system. Exploitation of this issue may allow an attacker to gain unauthorized...

Envoy Admin Interface Exposed through prometheus metrics endpoint

Impact A user with access to a Kubernetes cluster where Envoy Gateway is installed can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by Envoy Gateway. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration...

CVE-2025-24030

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...