Mail.ru: Раскрытие информации о совершенных операциях

History API in pandao.ru could disclosure non-personalized data about last operations...

Information disclosure

SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application...

Adobe Acrobat/Reader Data Disclosure Vulnerability

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. A data disclosure vulnerability exists in Adobe Acrobat/Reader. An attacker could exploit this vulnerability to obtain information...

FreeBSD Input Validation Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD. An attacker could exploit this vulnerability to disclose kernel data used in system calls...

CVE-2019-7535

index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology...

CVE-2019-7535

CVE-2019-7535 affects Gurock TestRail, specifically the index.php endpoint in version 5.3.0.3603. The issue leaks potentially sensitive information when handling an invalid request, demonstrated by full path disclosure and confirmation that PHP is used as the backend technology. The available doc...

Access Control Bypass

slixmpp is vulnerable to access control bypass. The vulnerability exists because the default permissions for persistent storage of private data on a PEP node is not set properly, disclosing private data that have been published to a PEP node to all the contacts of the victim...

CVE-2018-15658

CVE-2018-15658 affects 42Gears SureMDM (pre-2018-11-27). The issue arises when session validation runs after initial markup on /console/ConsolePage/Master.html, allowing an attacker to view the markup that would be shown to an authenticated user and, per the vulnerability description, access unpr...

CVE-2018-19724

Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2018-19727

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2018-19726

Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

Adobe Experience Manager Forms Cross-Site Scripting Vulnerability

Adobe Experience Manager Forms is the United States of America Odobie Adobe company's set of solutions for form content management. The product is mainly used to synchronize form data. A cross-site scripting vulnerability exists in Adobe Experience Manager Forms versions 6.4, 6.3, and 6.2. A remo...

PT-2019-18293 · Foxit · Foxit Phantompdf

Name of the Vulnerable Software and Affected Versions: Foxit PhantomPDF affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on vulnerable installations. It requires user interaction, such as visiting a malicious page or opening a...

The vulnerability of the web interface of Cisco IP Phone 8800 Series software allows a intruder to inject arbitrary code into the uploaded web page or disclose protected information.

The vulnerability of the web interface of Cisco IP Phone 8800 Series software lies in errors in the validation of data provided by users. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web page that is loaded, or to disclose protected information...

IBM Security Identity Manager XML External Entity Injection (XXE) Vulnerability

IBM Security Identity Manager is a policy-based, automated solution for managing user access rights in IT environments, helping to drive efficient identity management and oversight across the enterprise. An XML External Entity Injection XXE vulnerability exists in the IBM Security Identity Manage...

CVE-2018-2019

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265...

Unspecified vulnerability in LCDS LAquis SCADA (CNVD-2019-28114)

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. A security vulnerability exists in LCDS LAquis SCADA version 4.1.0.3870. The...

LAquis SCADA Input Validation Vulnerability

LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. An input validation vulnerability exists in LAquis SCADA version 4.1.0.3870, which can be exploited by an attacker to execute code with the help of a specially crafted report formatted file, disclose data or cause a...

LCDS LAquis SCADA Code Injection Vulnerability

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. A code injection vulnerability exists in LCDS LAquis SCADA version 4.1.0.387...

LCDS LAquis SCADA Out-of-Bounds Write Vulnerability

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. An out-of-bounds write vulnerability exists in LCDS LAquis SCADA version...