User Meta WP Plugin < 3.1 - Sensitive Information Exposure

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. id: CVE-2024-33575 info: name: User Meta WP Plugin 3.1 -...

WyreStorm Apollo VX20 - Information Disclosure

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext credentials for the SoftAP access point Router /device/config using an HTTP GET request. id: CVE-2024-25735 info: name: WyreStorm Apollo VX20 - Information Disclosure author: johnk3r...

Argo CD Unauthenticated Access to sensitive setting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. id: CVE-2024-37152 info: name: Ar...

Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure

Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system. id: CVE-2024-3742 info: name: Electrolink FM/DAB/TV Transmitter controlloLogin.js - Credentials Disclosure author: Farish severity: high description: | Electrolink...

FleetCart 4.1.1 - Information Disclosure

Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId". id: CVE-2024-5230 info: name: FleetCart 4.1.1 - Information Disclosure author: s4e-io severity: medium description: | Issues wi...

NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getitem function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data includi...

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

Jakarta Tomcat 3.1 and 3.0 - Information Disclosure

Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access. id: CVE-2000-0760 info: name: Jakarta Tomcat 3.1 and 3.0 -...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

D-Link DIR-605 - Information Disclosure

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page id: CVE-2021-40655 info: name: D-Link DIR-605 - Information Disclosure author: DhiyaneshDK severity: high...

CVE-2026-85068 NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ipponcommand in drivers/blazerusb.c partially initializes char tmp64 with a short Megatec status query and then passes a fixed...

CVE-2026-85068

The Network UPS Tools (NUT) software, versions 2.4.2 through 2.8.5 , is vulnerable to an information disclosure flaw in the ippon_command function within drivers/blazer_usb.c. The root cause is the partial initialization of the char tmp[64] buffer; the application performs a short status query bu...

CVE-2026-42533

CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE CVSS 9.2 Critical — Pre-auth heap buffer overflow + info leak in nginx Affected: nginx 0.9.6 – 1.30.3 / 1.31.2 | Patched: 1.30.4 / 1.31.3 Architecture ┌─────────────────────────────────────┐ │ Host machine │ │ │ PoC scripts ──────┤ :8080...

CVE-2025-65264

CVE-2025-65264 Description In CPU‑Z 2.17 and earlier and other products that use CPU-Z driver with version 1.0.6.1 and earlier, the driver e.g. cpuz161.sys dereferenced a value from a user‑supplied address and wrote it to the system buffer supplied by the caller. An attacker could read arbitrary...

x18-leak

x18-leak iOS 11.2 introduced a kernel information leak that could be used to determine the kASLR slide. The issue was the result of a newly added feature, ARMKERNELPROTECT, that inadvertently caused the address of the kernel function Lel0synchronousvector64long to appear in register x18 when...

chakra-2016-11

chakra.dll Info Leak + Type Confusion for RCE Proof-of-Concept exploit for Edge bugs CVE-2016-7200 & CVE-2016-7201 Tested on Windows 10 Edge modern.ie stable. FillFromPrototypesTypeConfusion.html: WinExec notepad.exe FillFromPrototypesTypeConfusionNoSC.html: 0xcc INT 3 To run 1. Download...

cve-2019-6207

CVE-2019-6207 $ clang exploit.c -o exploit $ ./exploit CVE-2019-6207 exploit to leak 4 bytes of arbitrary kernel memory Tested on MacOS 10.14.1, should works on: MacOS wop != NETRTDUMP2 int size = rtmsg2RTMGET, &info, NULL, w, credp; if w-wreq != NULL && w-wtmem != NULL struct rtmsghdr rtm = stru...

CVE-2019-8540

CVE-2019-8540 Kernel Stack info leak at exportObjectToClient function bug details: macOSrelease; return kIOReturnSuccess; We know ioobjectt length is 8 bytes and at 1 which was force convert to machportnamet4 bytes ,so lead to the high 4 bytes not inital...

CVE-2022-2078

CVE-2022-2078 $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...

CVE-2019-6207

CVE-2019-6207 this vulneriliabity can be trigger in sandbox at macOSwop == NETRTFLAGS || w-wop == NETRTFLAGSPRIV && !rt-rtflags & w-warg goto done; / If the matching route has RTFLLINFO set, then we can skip scrubbing the MAC only if the outgoing interface is not loopback and the process has...