415 matches found
CVE-2024-50512
CVE-2024-50512 affects the WordPress plugin Posti Shipping (versions
CVE-2024-49235 WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: from n/a through = 1.10.2...
CVE-2024-6400
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in...
CVE-2024-6400 Cleartext Storage of Username and Password in Finrota's Netahsilat
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in...
CVE-2024-42406
Mattermost CVE-2024-42406 affects Mattermost Server versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x
CVE-2024-6406 Sensetive Data Exposure in Yordam Information Technology's Mobile Library Application
Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data. This issue affects Mobile Library Application: before 5.0...
CVE-2024-3305
Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...
CVE-2024-3305
The CVE-2024-3305 issue affects Utarit Information SoliClub (mobile app). It is an Authorization Bypass Through a User-Controlled Key that enables retrieval of embedded sensitive data due to missing authorization checks. Affected versions are SoliClub on iOS before 4.4.0 and Android before 5.2.1....
CVE-2024-8749
SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/www/html/src/classes/modules/api/model/cmdb/isysapimodelcmdbobjectsbyrelation.class.php and retrieve all the information stored in the...
CVE-2024-8466
CVE-2024-8466 describes a SQL injection in PHPGurukul Job Portal (version 1.0) where the CATEGORY parameter in /jobportal/admin/category/controller.php is processed unsafely, enabling an attacker to craft queries to retrieve information stored in the system. The connected documents confirm affect...
CVE-2024-8464 SQL injection vulnerability in Job Portal
SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it...
HP SiteScope SOAP Call GetSiteScopeConfiguration Configuration Access
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP SiteScope SOAP Call getSiteScopeConfiguration Configuration Access', 'Description' = %q This module exploits an authentication bypass...
Multiple DVR Manufacturers Configuration Disclosure
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multiple DVR Manufacturers Configuration Disclosure', 'Description' = %q This module takes advantage of an authentication bypass vulnerability at...
Yokogawa BKBCopyD.exe Client
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Yokogawa BKBCopyD.exe Client', 'Description' = %q This module allows an unauthenticated user to interact with the Yokogawa CENTUM CS3000...
TeamTalk Gather Credentials
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TeamTalk Gather Credentials', 'Description' = %q This module retrieves user credentials from BearWare TeamTalk. Valid administrator credentials a...
CVE-2022-26327
OpenText Performance Center (Windows) 12.63 is affected by CVE-2022-26327, described as Exposure of Sensitive Information to an Unauthorized Actor, enabling retrieval of embedded sensitive data. Connected sources (PT Security PT-2024-11542) confirm the vulnerable version (12.63) and recommend upd...
CVE-2022-26327 Stored cross-site scripting (XSS) has been discovered in OpenText™ Performance Center
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded Sensitive Data.This issue affects Performance Center: 12.63...
CVE-2024-7411
The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing direct access to the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php. This makes it possible for unauthenticated attackers to...
CVE-2024-7416 Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure
The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...
CVE-2024-33972
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'events' in '/report/eventprint.php'...