Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

The plugin requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability. PoC When a guest make a booking via sending "action:...

WordPress Booking Package plugin <= 1.5.28 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Huli Cymetrics in WordPress Booking Package plugin versions = 1.5.28. Solution Update the WordPress Booking Package plugin to the latest available version at least 1.5.29...

CVE-2022-24714 Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

CVE-2022-24714 Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

CVE-2021-25087

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords fixed in 3.2.24 and files Master Keys fixed ...

CVE-2021-24824

The field shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the...

CVE-2021-24824

The field shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the...

Information disclosure

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form...

CVE-2021-24824

The CVE-2021-24824 entry concerns the WordPress Custom Content Shortcode plugin before 4.0.1. The vulnerability allows authenticated users with a low-privilege role (as low as contributor) to access arbitrary post metadata, enabling potential sensitive data disclosure (e.g., WooCommerce order ema...

CVE-2021-24824 Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

The field shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the...

WordPress 的 Custom Content Shortcode插件访问控制错误漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress application plugin. WordPress Custom Content Shortcode plugin versions prio...

The vulnerability of NETGEAR’s integrated router software, including models R6260, R6800, R6700v2, R6900v2, R7450, AC2100, AC2400, and AC2600, arises due to buffer overflows in the stack. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the embedded software of NETGEAR routers such as R6260, R6800, R6700v2, R6900v2, R7450, AC2100, AC2400, and AC2600 arises due to buffer overflow on the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility o...

The vulnerability of the built-in software of NETGEAR’s RBK352, RBR350, and RBS350 routers lies in the lack of protection for service data, which allows attackers to exploit this weakness to disclose protected information.

The vulnerability of NETGEAR’s embedded routing software, such as RBK352, RBR350, and RBS350, is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

The vulnerability of the file system filter driver of the Microsoft Windows operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the file system filter driver in the Microsoft Windows operating system is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Microsoft Visual Basic development environment and the Microsoft Office suite relates to the disclosure of information in the error-prone data area, allowing the disclosure of protected information.

The vulnerability of the Microsoft Visual Basic development environment and the Microsoft Office suite is related to the disclosure of sensitive information in error-prone data areas. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the Bot Framework SDK, related to improper code generation management, allows a perpetrator to disclose protected information.

The vulnerability of the Bot Framework SDK is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Omron CX-Programmer 资源管理错误漏洞

Omron CX-Programmer is a PLC Programmable Logic Controller programming software from Omron, Japan. A security vulnerability exists in CX-Programmer v9.76.1 and earlier versions, which can be exploited by an attacker to trick a user into opening a carefully crafted CXP file to cause information...

Omron CX-Programmer缓冲区错误漏洞

Omron CX-Programmer is a PLC Programmable Logic Controller programming software from Omron, Japan. A security vulnerability exists in CX-Programmer v9.76.1 and earlier versions, which can be exploited by an attacker to cause a user to open a carefully crafted CXP file, leading to information...

WordPress Amelia plugin <= 1.0.46 - Arbitrary Appointments Update and Sensitive Data Disclosure vulnerability

Arbitrary Appointments Update and Sensitive Data Disclosure vulnerability discovered by Huli Cymetrics in WordPress Amelia plugin versions = 1.0.46. Solution Update the WordPress Amelia plugin to the latest available version at least 1.0.47...

The vulnerability of the Windows Common Log File System Driver in Windows operating systems allows a hacker to disclose protected information.

The vulnerability of the Windows Common Log File System Driver in Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...