Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs

A data disclosure flaw was found in Ansible when using the Splunk and Sumologic modules, as they are not respecting when the flag nolog is enabled. This flaw can disclose and collect sensitive data from the system and expose it to an attacker...

The vulnerability of the Form component in the Symfony software development and web application management platform allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Form component in the Symfony software development and web application management platform exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a specially crafted HTTP request,...

Huawei P20 Improper Access Control Vulnerability

Huawei P20 is a smartphone from Chinese company Huawei Huawei. An improper access control vulnerability exists in the Huawei Share feature in the Huawei P20. The vulnerability can be exploited by an attacker to disclose information by tricking a user into installing a malicious app and establishi...

CVE-2019-8241

Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure...

Adobe Media Encoder Out-of-Bounds Read Vulnerability (CNVD-2019-41626)

Adobe Media Encoder is an audio and video encoding application from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Media Encoder 13.1 and earlier versions for Window and macOS platforms. An attacker can exploit this vulnerability to obtain sensitive...

VulnCheck KEV: CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

UBUNTU-CVE-2019-11135

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access...

The vulnerability of the Core RDBMS component of the database management system Oracle Database Server allows a hacker to disclose protected information.

The vulnerability of the Core RDBMS component of the database management system, Oracle Database Server, is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of Norton Password Manager’s password manager component lies in the lack of protection for service data, which allows attackers to access and disclose the protected information.

The vulnerability of Norton Password Manager’s password manager component is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a hacker to access and disclose the protected information...

The vulnerabilities of the components of the Automationworx Software Suite, including PC Worx, PC Worx Express, and Config+, allow attackers to disclose protected information and execute arbitrary code.

The vulnerability of the components of the Automationworx Software Suite, including PC Worx, PC Worx Express, and Config+, lies in the ability to read data beyond the designated memory area. Exploiting this vulnerability allows an attacker to disclose sensitive information and execute arbitrary...

Smule: stored xss in https://www.smule.com

hi team , I found a stored xss in www.smule.com Summary: add summary of the vulnerability The most damaging type of XSS is Stored XSS Persistent XSS. An attacker uses Stored XSS to inject malicious content referred to as the payload, most often JavaScript code, into the target application. If the...

Moderate: Red Hat Security Advisory: ansible security update

An update for ansible is now available for Red Hat OpenStack Platform 14.0 Rocky. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Trend Micro Discloses Insider Threat Impacting Some of its Consumer Customers

We recently became aware of a security incident that resulted in the unauthorized disclosure of some personal data of an isolated number of customers of our consumer product. We immediately started investigating the situation and found that this was the result of a malicious insider threat. The...

YouPHPTube LiveChat Plugin SQL Injection Vulnerability

YouPHPTube is an open source YouTube clone script. A SQL injection vulnerability exists in the LiveChat plugin in YouPHPTube 7.7 and earlier versions. The vulnerability stems from a failure to properly validate user input passed via the livestreamcode POST parameter to...

The vulnerability of the Client programs component of the MySQL Server database management system allows attackers to disclose sensitive information.

The vulnerability of the Client programs in the MySQL Server database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

CVE-2019-18227

Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data...

CVE-2019-18227

Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data...

CVE-2019-18227

CVE-2019-18227 affects Advantech WISE-PaaS/RMM, versions 3.3.29 and prior. The vulnerability is an XML External Entity (XXE) processing flaw in the RecoveryMgmt/AccountMgmt/other XML parsing paths that can allow a remote attacker to disclose sensitive data from the target system. Public descripti...

ClipSoft REXPERT File Upload Vulnerability

ClipSoft REXPERT is a report generation program from ClipSoft Korea. A file upload vulnerability exists in ClipSoft REXPERT. The vulnerability can be exploited by an attacker to upload arbitrary local files and disclose sensitive information via ActiveX methods...

CVE-2019-17325

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a...