Information Disclosure

curl is vulnerable to information disclosure. The wrong buffer is sent to the user when trying to obtain a file using file://. This can result in confidential information being disclosed...

Bitotal Number Error Vulnerability

Bitotal TFUND is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in TFUND. An attacker can exploit the vulnerability to retrieve generated tokens...

MoxyOnePresale Digital Error Vulnerability

MoxyOnePresale is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in MoxyOnePresale. An attacker could use this vulnerability to retrieve generated tokens...

SpadePreSale Digital Error Vulnerability

SpadePreSale is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in SpadePreSale. An attacker could use this vulnerability to retrieve generated tokens...

CVE-2020-11042

In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in updatereadiconinfo. It allows reading a attacker-defined amount of client memory 32bit unsigned - 4GB to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has...

CVE-2020-10974

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3,...

CVE-2020-12687

An issue was discovered in Serpico before 1.3.3. The /admin/attacmentsbackup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users including administrators from the database...

CVE-2020-12687

An issue was discovered in Serpico before 1.3.3. The /admin/attacmentsbackup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users including administrators from the database...

YesWiki cercopitheque 2020.04.18.1 - (id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: YesWiki cercopitheque 2020.04.18.1 - 'id' SQL Injection Exploit Author: coiffeur Vendor Homepage: https://yeswiki.net/ Software Link: https://yeswiki.net/, https://github.com/YesWiki/yeswiki Version: YesWiki cercopitheque...

[SECURITY] [DSA 4676-1] salt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4676-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 06, 2020 https://www.debian.org/security/faq -...

CVE-2020-3259

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential...

CVE-2020-12142

CVE-2020-12142 affects the EdgeConnect appliance. An admin user with shell access can retrieve IPSec UDP key material (IPSec seed and nonce) via CLI, REST APIs, or the Linux shell, enabling potential decryption of in-flight traffic. The issue requires administrative access and is described across...

CVE-2020-12142 IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials

IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative...

Exploit for CVE-2020-11651

CVE-2020-11651 An issue was discovered in SaltStack Salt befo...

PYSEC-2020-102

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

CVE-2020-12478

TeamPass 2.1.27.36 is affected by CVE-2020-12478 due to improper authentication. An unauthenticated attacker can retrieve files from the web root, potentially exposing backups and LDAP debug files and enabling data exposure or unauthorized operations. The connected Nuclei template confirms the vu...

CVE-2020-12478

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

Learnpress < 3.2.6.8 - Authenticated Time Based Blind SQL Injection

This could allow a low privilege user, to perform a time based SQL Injection attack and retrieve data from the DB, such as hashed passwords...