WordPress Debug Log – Manger Tool Plugin <= 1.4.5 is vulnerable to Sensitive Data Exposure

Software Debug Log – Manger Tool Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-34798 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 669450ad8391 Credits emad Required...

CVE-2024-4622 alpitronic Hypercharger EV Charger Use of Default Credentials

If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator...

PT-2024-31925 · Alpitronic · Alpitronic Hypercharger Ev Charging Devices

Name of the Vulnerable Software and Affected Versions: alpitronic Hypercharger EV charging devices affected versions not specified Description: The issue concerns alpitronic Hypercharger EV charging devices that can expose a web interface protected by authentication if misconfigured. If the defau...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

JWT Exposure

@valtimo/components is vulnerable to JWT Exposure. The vulnerability is due to a misconfiguration of the Form.io component, which exposes the user's access token JWT to api.form.io via the x-jwt-token header, allowing attackers to retrieve personal information or execute requests to the Valtimo...

@valtimo/components exposes access token to form.io

Impact When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is...

GHSA-XCP4-62VJ-CQ3R @valtimo/components exposes access token to form.io

Impact When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is...

CVE-2024-34706 @valtimo/components exposes access token to form.io

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706 @valtimo/components exposes access token to form.io

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706

Valtimo exposes the user JWT in the x-jwt-token header to api.form.io due to a Form.io component misconfiguration. An attacker with network access to api.form.io and the Valtimo API, and who can read the token TTL (default 5 minutes), can access personal data or perform actions on behalf of the l...

PT-2024-26120 · Form.Io +2 · Form.Io +2

Name of the Vulnerable Software and Affected Versions: Valtimo versions prior to 10.8.4 Valtimo versions prior to 11.1.6 Valtimo versions prior to 11.2.2 Description: Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of t...

CVE-2023-37526

The CVE-2023-37526 entry concerns HCL DRYiCE Lucy (now AEX). A CORS misconfiguration in the mobile app could allow unauthorized access to application resources from any web domain and enable cache poisoning, per sources in NVD/CVE records. The root cause is a CORS misconfiguration in the app, wit...

CVE-2023-37526 HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability

HCL DRYiCE Lucy now AEX is affected by a Cross Origin Resource Sharing CORS vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks...

CVE-2023-37526 HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability

HCL DRYiCE Lucy now AEX is affected by a Cross Origin Resource Sharing CORS vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks...

PT-2024-12630 · Hcl · Hcl Dryice Lucy

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE Lucy now AEX affected versions not specified Description: The issue is related to a Cross Origin Resource Sharing CORS misconfiguration in the mobile app, which could allow unauthorized access to application resources from any web...

WordPress Easy Digital Downloads Plugin <= 3.2.11 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.11 Fixed in 3.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c5d829b14d8d Credits Dhabaleshwar D...

Sensitive Information Disclosure

org.eclipse.edc: data-plane-http-oauth2-core is vulnerable to Sensitive Information Disclosure. The vulnerability arises from a misconfiguration in the OAuth2-protected data sink feature, where the consumer-provided clientSecretKey is resolved in the context of the provider's vault instead of the...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A denial-of-service vulnerability exists in F5 BIG-IP IPsec, which is due to a flaw in the configuration of IPsec on a virtual...

CVE-2023-27360

NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2023-27360

NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...