Swagger UI Security Vulnerability

Swagger UI is an open source tool that supports visualizing and being able to interact with API resources. A security vulnerability exists in Swagger UI versions prior to v2.1.0, which stems from the default swagger-ui configuration exposing all files in the module...

PT-2023-31881 · Unknown · Implecode Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: impleCode Product Catalog Simple versions 1.7.6 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who shoul...

Malicious code in create-codecpetjs-bdd-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01558db89dd1a8c91f89f5484278ccabfae35f95f9d6500a80a42d59a704c4b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Test code in published microsoft-graph-core package exposes phpinfo()

More info at https://nvd.nist.gov/vuln/detail/CVE-2023-49283...

PT-2023-29721 · Libsyn · Libsyn Publisher Hub

Name of the Vulnerable Software and Affected Versions: Libsyn Publisher Hub versions 1.4.4 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have...

Apache DolphinScheduler Security Vulnerability

Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache USA Foundation. A security vulnerability exists in Apache DolphinScheduler prior to version 3.2.1. An attacker could exploit the vulnerability to obtain sensitive information...

CVE-2023-5777 Weintek EasyBuilder Pro Use of Hard-coded Credentials

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-40421

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access sensitive user data...

PT-2023-21036 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the GetActiveToiletPasses method, allowing unauthenticated attackers to retrieve student information. Recommendations: For versions 3.1.0...

WordPress Plugin Profile Extra Fields by BestWebSoft Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress Plugin...

CVE-2023-38256

Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 vulnerable to a path traversal attack, which could allow an attacker to access files stored on the system...

PT-2023-30448 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions up to 4.1.3 Description: A vulnerability was found in the file /upload/ueditorConfig?action=config, affecting an unknown function. The manipulation leads to files or directories being made accessible. It is possible to...

API Misuse: Hacker Exposes 2.6M Duolingo Users’ Emails & Names

By Waqas Duolingo Investigates Data Leak as Hacker Shares Personal User Information on Hacker Forums and Telegram. This is a post from HackRead.com Read the original post: API Misuse: Hacker Exposes 2.6M Duolingo Users Emails & Names...

The vulnerability of the Intel Unite Client conference communication software for Windows and MacOS relates to an uncontrolled search path element, allowing a malicious individual to gain unauthorized access to sensitive information.

The vulnerability of the Intel Unite Client conference communication software for Windows and MacOS relates to an uncontrolled element in the search process. Exploiting this vulnerability can allow a malicious individual to gain unauthorized access to sensitive information...

PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2023-33368

Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes...

AXIS A1001 Network Door Controller Flaw Exposes Secure Facilities

By Deeba Ahmed The new discovery could have far-reaching implications for Physical Access Control Systems and sensitive facilities. This is a post from HackRead.com Read the original post: AXIS A1001 Network Door Controller Flaw Exposes Secure Facilities...

Malicious code in cloudsplaining (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9d821ad444b4ae2d16e2fa2f9479b0175bfad2283012e98bf2d72d6d9f8fb71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-34834

A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint...

GHSA-JHPR-J7CQ-3JP3 Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Impact An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the...