CVE-2022-43689

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure...

GLSA-202207-01 : HashiCorp Vault: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202207-01 HashiCorp Vault: Multiple Vulnerabilities - HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. CVE-2020-25594 - HashiCorp...

Information disclosure

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain...

CVE-2022-30494

In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs...

c-toxcore 信息泄露漏洞

c-toxcore is a peer-to-peer serverless instant messenger designed to make security and privacy easier for the average user. TokTok c-toxcore suffers from an information disclosure vulnerability that stems from the fact that the Onion module in toxcore prior to version 0.2.2 does not restrict whic...

Sifchain: Origin IP Disclosure Vulnerability

Summary: It is possible to access origin IP servers served by nginx and not cloudflare. Even though these IP's don't serve a functional version of the app it is possible to enable DDoS attacks by bypassing cloudflare protections. Steps To Reproduce: Even though these IP's don't serve a functional...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.9.0 ESR +  CVE-2020-26974) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF13 + CP4MCM2.2

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2020-26974, CVE-2020-35111, CVE-2020-26973, CVE-2020-26978, CVE-2020-26971, CVE-2020-35112, CVE-2020-35113 Vulnerability Details CVEID: CVE-2020-26974 DESCRIPTION: Mozilla Firefox could allow a remote attacker to...

CVE-2021-3024

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

Informatica: Improper Sanitization leads to XSS Fire on admin panel

Summary Because the HTML is not sanitized when taking the input on https://accounts.informatica.com/registration.html, the input is vulnerable to XSS. When a payload such as " is put into the form under company it triggers a blind xss. When the payload successfully is loaded, it dumps information...

Informatica: ..; bypass leading to tomcat scripts [Unauthenticated]

Hello all Using the technique ..; i was able to bypass the protection mechanism to access Tomcat Example Scripts hosted at https://███/. Steps to reproduce 1 - Open all URL's bellow inside your browser https://█████████/..;/examples/servlets/servlet/SessionExample | Will lead to Session...

MTN Group: XMLRPC, Enabling XPSA and Bruteforce and DOS + A file disclosing installer-logs.

Summary: XMLRPC+Installerlogs+BackupFilename+Adminusername+disclosure Steps To Reproduce: 1. I was able to successfully exploit XMLRPC with the traditional method, the brute-force was done the username was there in the Installer Logs 2. path to XMLRPC is http://13.92.255.102/xmlrpc.php + the...

CVE-2019-19910

The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 1.35 and/or 1.34 mishandles certain HTML attributes, as demonstrated by IMG onmouseover= impact is XSS and IMG src=http impact is disclosing the client's IP address. This can occur within a talk page topical header that is viewed...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure User...

CVE-2019-8097

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an internal ip disclosure vulnerability. Successful exploitation could lead to...

CVE-2019-8097

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an internal ip disclosure vulnerability. Successful exploitation could lead to...

CVE-2019-8097

CVE-2019-8097 affects Adobe Acrobat and Reader (various older builds listed in the description) and corresponds to an internal IP disclosure vulnerability. Successful exploitation could lead to information disclosure. The provided sources (NVD/Nessus-APSB19-41 entries) describe multiple CVEs unde...

Adobe Acrobat 2017 Security Updates (APSB19-41) - Windows

Adobe Acrobat 2017 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:acrobat";...

Adobe Acrobat Reader DC (Classic Track) Multiple Vulnerabilities (APSB19-41) - Mac OS X

Adobe Acrobat Reader DC Classic Track is prone to multiple arbitrary code execution vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Adobe Acrobat DC (Continuous Track) Security Updates (APSB19-41) - Windows

Adobe Acrobat DC Continuous Track is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Acrobat and Reader Internal IP Disclosure (APSB19-41: CVE-2019-8097)

A vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...