Sensitive Information Disclosure

Apache Kylin is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the exposure of credentials within the kylin.properties file through the Server Config web interface when the Kylin service runs over HTTP. This could allow an attacker to gain unauthorized access to the...

Qiyu iFair Security Breach

Qiyu iFair is a business management software from Qiyu Inc. A security vulnerability exists in Qiyu iFair version 23.8ad0 and prior versions. A remote attacker can exploit this vulnerability to obtain sensitive information via the uploadimage component...

Security feature bypass

The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference IDOR vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter...

CVE-2024-0212

The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API...

Authentication flaw

The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API...

CVE-2024-0212

The CVE-2024-0212 entry concerns the WordPress Cloudflare plugin. Concrete details from connected sources show: versions up to 4.12.2 are vulnerable due to a missing capability check in the initProxy function, allowing authenticated users with subscriber access and above to send requests proxied ...

MachineSense FeverWarn Access Control Error Vulnerability

MachineSense FeverWarn is a temperature detection device from MachineSense. MachineSense FeverWarn suffers from an Access Control Error vulnerability that stems from improperly protected programmable interfaces APIs that can be accessed without authentication. A remote attacker can retrieve and...

CVE-2024-23747

The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference IDOR vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter...

The vulnerability of the rds_recv_track_latency function in the Linux kernel’s net/rds/af_rds.c file, which allows a hacker to compromise the accessibility of protected information.

The vulnerability of the rdsrecvtracklatency function in the Linux operating system’s kernel is related to a single-shift error. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

Moderna Sistemas ModernaNet Hospital Management System Security Vulnerability

Moderna Sistemas ModernaNet Hospital Management System is a hospital management system from Moderna Sistemas. A security vulnerability exists in Moderna Sistemas ModernaNet Hospital Management System version 2024, which arises from a security issue in the way the system handles access to user dat...

The vulnerability of the save_management_settings() function in the InstaWP Connect plugin of the WordPress content management system allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the savemanagementsettings function in the InstaWP Connect plugin of the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read, edit, or delete access to data...

OESA-2024-1099 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle...

PT-2024-1433 · Unknown · Machinesense

Name of the Vulnerable Software and Affected Versions: MachineSense affected versions not specified Description: The MachineSense application programmable interface API is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive...

The vulnerability of the Web page rendering module in WebKit operating systems for Mac OS, tvOS, watchOS, iOS, and iPadOS allows attackers to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.

The vulnerability of the Web page rendering module in WebKit operating systems for Mac OS, tvOS, watchOS, iOS, and iPadOS relates to the execution of operations beyond the buffer during the processing of HTML content. Exploiting this vulnerability can allow a remote attacker to gain unauthorized...

Vulnerabilities fixed in Jenkins

Several vulnerabilities have been fixed in Jenkins core and modules. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS. Circumvention of security...

Views for WPForms < 3.2.3 - Missing Authorization via get_form_fields

Description The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getformfields' function in all versions up to, and including, 3.2.2. This makes it possible for...

The vulnerability of the Setup sub-component, part of the Admin component in Oracle Knowledge Management, a system for automating business processes within the Oracle E-Business Suite, allows an attacker to gain access to read, modify, add, or delete data.

The vulnerability of the Setup sub-component and the Admin component of Oracle Knowledge Management, a system for automating business processes within the Oracle E-Business Suite, exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating...

The vulnerability of the sub-component of the CRM User Management Framework in the Oracle Common Applications of the Oracle E-Business Suite allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications system, part of the Oracle E-Business Suite, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to read, modify, add, or delete...

The vulnerability of the Documents component of the Oracle One-to-One Fulfillment application system, a business automation solution from Oracle E-Business Suite, allows an attacker to gain access to read, modify, add, or delete data.

The vulnerability of the Documents component in the Oracle One-to-One Fulfillment system, a business automation solution from Oracle E-Business Suite, exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to...

Ninja Tables < 5.0.7 - Contributor+ Table Data Access

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the dragAndDropExport function. This makes it possible for authenticated attackers, with contributor-level access and above, to export table data...