3359 matches found
CVE-2024-12651
Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0...
PTT HGS Mobile App 安全漏洞
PTT HGS Mobile App is a mobile application from PTT Turkey that is used to facilitate the management and payment of Highway Electronic Toll Collection System HGS fees. A security vulnerability exists in PTT HGS Mobile App versions prior to 6.5.0, which stems from the presence of a vulnerability...
Doxbin Data Breach: Hackers Leak 136K User Records and Blacklist File
Doxbin Data Breach: Hackers leak 136,000+ user records, emails, and a ‘blacklist’ file, exposing those who paid to…...
PT-2025-6969 · Gatesair · Gatesair Maxiva Vaxt
Name of the Vulnerable Software and Affected Versions: GatesAir Maxiva UAXT, VAXT transmitters affected versions not specified Description: A session hijacking issue exists in the web-based management interface, allowing unauthenticated attackers to access exposed log files at "/logs/debug/xteLog...
Qardio ARM A100 安全漏洞
Qardio ARM A100 is an automated blood pressure monitor from Qardio, USA. A security vulnerability exists in the Qardio ARM A100 that stems from exposing sensitive data such as usernames and passwords in plist files...
Massive 1.17TB Data Leak Exposes Billions of IoT Grow Light Records
Massive 1.17 TB data leak exposes billions of records from a Chinese IoT grow light company. Wi-Fi passwords,…...
OmniGPT AI Chatbot Alleged Breach: Hacker Leaks User Data, 34M Messages
Hacker claims to have breached OmniGPT, leaking over 30,000 user email address, phone numbers, and 34 million lines of chat messages. Data includes API keys, credentials, and file links...
CVE-2024-35279
A stack-based buffer overflow CWE-121 vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to...
7,000 Exposed Ollama APIs Leave DeepSeek AI Models Wide Open to Attack
UpGuard discovers exposed Ollama APIs revealing DeepSeek model adoption globally. See where these AI models are running and the security risks involved...
VMware Aria Operations Information Disclosure (VMSA-2025-0003)
The version of VMware Aria Operations running on the remote host is missing a vendor supplied patch. It is, therefore, affected by a information disclosure vulnerability that a malicious user with non-administrative privileges could exploit to retrieve credentials for an outbound plugin if a vali...
CVE-2022-29186
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the idrsa.pub public key of the keypair was copied to authorizedkeys files on remote host, those hosts...
CVE-2022-23768
This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device...
Banking Malware Uses Live Numbers to Hijack OTPs, Targeting 50,000 Victims
A banking malware campaign using live phone numbers to redirect SMS messages has been identified by the zLabs research team, uncovering 1,000+ malicious apps and 2.5GB of exposed data...
CVE-2020-14496
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information ...
CVE-2020-5262
In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...
CVE-2020-13359
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...
CVE-2020-26226
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a U...
CVE-2024-7940
The product exposes a service that is intended for local only to all network interfaces without any authentication...