CVE-2024-27090 Decidim vulnerable to data disclosure through the embed feature

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded such as a...

CVE-2023-33859 IBM Security ReaQta information disclosure

IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697...

Decidim vulnerable to data disclosure through the embed feature

Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches version 0.27.6...

GHSA-QCJ6-VXWX-4RQV Decidim vulnerable to data disclosure through the embed feature

Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches version 0.27.6...

WordPress plugin Houzez CRM security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Decidim vulnerable to data disclosure through the embed feature

Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches Version 0.27.6...

The vulnerability of the Jenkins Structs Plugin, related to the disclosure of information through registration files, allows a perpetrator to gain unauthorized access to the protected information.

The vulnerability of the Jenkins Structs Plugin is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

CVE-2024-39593

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities...

OpenSearch Dashboards Reports Security Vulnerability

OpenSearch Dashboards Reports is an OpenSearch open source application. It is used to export and automate PNG, PDF and CSV reports in OpenSearch Dashboard. A security vulnerability exists in OpenSearch Dashboards Reports prior to version 2.14, which stems from the system not properly checking if ...

MegaBIP Security Vulnerabilities

MegaBIP is a software for creating BIP websites. A security vulnerability exists in MegaBIP version 5.13 and earlier, which stems from a SQL injection vulnerability in the parameters that allows an unauthorized attacker to disclose database content and obtain an administrator token to modify page...

PT-2024-4981 · Microsoft · Message Queuing +1

Name of the Vulnerable Software and Affected Versions: Microsoft Message Queuing affected versions not specified Description: The vulnerability is related to insufficient protection of service data in Microsoft Message Queuing, which can allow an attacker to disclose protected information. It...

OpenSearch Dashboards Reports Security Vulnerability

OpenSearch Dashboards Reports is an OpenSearch open source application. It is used to export and automate PNG, PDF and CSV reports in OpenSearch Dashboard. A security vulnerability exists in OpenSearch Dashboards Reports prior to version 2.14, which stems from when accessing a resource in a priva...

PT-2024-27795 · Unknown · S3 Browser

Name of the Vulnerable Software and Affected Versions: S3Browser versions 10.9.9 through 11.4.5 Description: An issue in the S3 compatible storage component allows a remote attacker to obtain sensitive information. Recommendations: For versions 10.9.9 through 11.4.5, update to version 11.5.7 to...

The vulnerability of the query_contract_result function in the MCUDBHelper component of the corporate version of the PowerPanel Enterprise monitoring and control system allows a perpetrator to disclose protected information.

The vulnerability of the querycontractresult function in the MCUDBHelper component of the corporate version of the PowerPanel Enterprise monitoring and power source management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow...

The vulnerability of the Guided Procedures component of the SAP NetWeaver AS for Java software used for creating and deploying web applications allows a malicious individual to gain unauthorized access to confidential information.

The vulnerability of the Guided Procedures component in the SAP NetWeaver AS for Java web application creation and deployment software is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to...

The vulnerability of Sonatype Nexus Repository Manager lies in the improper restriction of the path name to the restricted directory. This allows attackers to disclose protected information.

The vulnerability of Sonatype Nexus Repository Manager is related to incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Mitsubishi Electric MELIPC Series Security Vulnerability

Mitsubishi Electric MELIPC Series is a series of industrial computers from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELIPC Series MI5122-VW firmware versions 05 through 07. An attacker could exploit this vulnerability to disclose, tamper with, corrupt,...

PT-2024-6409 · Unknown · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: The issue is related to an out-of-bounds read in the PDF-XChange Editor, which can allow remote attackers to disclose sensitive information on affected installations. This can...

The vulnerability of the BSON Handler component in the client library of PyMongo, which allows a hacker to disclose confidential information or cause service failures.

The vulnerability of the BSON Handler component in the PyMongo client library relates to reading data beyond the memory boundaries. Exploiting this vulnerability can allow an attacker to disclose confidential information or cause service failures...