721 matches found
The vulnerability of the IBM QRadar SIEM system for event collection and analysis lies in insufficient validation of requests on the server side. This allows attackers to send unauthorized requests and disclose sensitive information that should be protected.
The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to send unauthorized requests and disclose protected information...
CVE-2020-4635
IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames...
CVE-2020-8585
OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link plink...
CVE-2020-4189
IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 174850...
CVE-2020-27299
The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller versions prior to 6.3.0.8233...
Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure
The plugin did not check for user capability in the dmmexportdonations function, allowing any authenticated user to export a CSV file containing all donors personal information. GET /wp-admin/admin-post.php?action=dmmexport...
Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure
The plugin did not check for user capability in the dmmexportdonations function, allowing any authenticated user to export a CSV file containing all donors personal information. PoC GET /wp-admin/admin-post.php?action=dmmexport...
Honeywell OPC UA Tunneller
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Matrikon, a subsidiary of Honeywell Equipment: OPC UA Tunneller Vulnerabilities: Heap-based Buffer Overflow, Out-of-bounds Read, Improper Check for Unusual or Exceptional Conditions, Uncontrolled...
CVE-2020-25011
A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to get username and password by request /cgi-bin/webadminget.cgi script via the browser...
ListingPro < 2.6.1 - Unauthenticated Sensitive Data Disclosure (Usernames, Emails etc)
Unauthenticated users could gain access to sensitive data, such as usernames, full names, email addresses and in some case phone numbers by sending a request to /wp-admin/index.php?download-lp-users=yes which is registered to the init hook...
NZXT CAM Permission License and Access Control Issues Vulnerability
NZXT CAM is a performance monitoring software for gaming computers from NZXT USA. The software can be used to manage computer performance, temperature, and devices to ensure that the computer is at optimal performance. NZXT CAM version 4.8.0 suffers from a Privilege Permission and Access Control...
Total Upkeep by BoldGrid < 1.14.10 - Sensitive Data Disclosure (Server IP Address, UID etc)
The plugin does not restrict access to a file containing sensitive information, such as the real server IP address, UID and so on, which may help attackers in further attacks. GET /wp-content/plugins/boldgrid-backup/cli/env-info.php ..., "phpuname":"Linux wordpress-server X.X.X-XX-generic XX-Ubun...
CVE-2020-25838
Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerability could be exploited to disclose unauthorized sensitive information...
CVE-2020-7541
A CWE-425: Direct Request 'Forced Browsing' vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules see security notification for affected versions, that could cause disclosure of sensitive data when sending a...
CVE-2020-7541
The CVE-2020-7541 issue affects Schneider Electric Modicon devices: Modicon M340 Web Server, Legacy Modicon Quantum and Modicon Premium, and related Communication Modules. It is a CWE-425 Direct Request (Forced Browsing) flaw that could disclose sensitive data when a specially crafted HTTP reques...
Binary vulnerability in pngcheck ch***_ch***_na*** function
pngcheck is used to verify the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRC, aka checksum and decompressing the image data; it can optionally dump almost all block-level information in the image in a human-readable form. A binary vulnerability exists in the pngcheck...
SQL Injection Vulnerability in DBShop
DBShop is an e-commerce system. DBShop suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...
S-CMS School Building System suffers from SQL Injection Vulnerability
S-CMS School Building System is a content management system for school websites. A SQL injection vulnerability exists in S-CMS School Building System. An attacker can exploit the vulnerability to obtain sensitive database information...
CVE-2020-6367
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that t...