GHSA-QG3G-2MGH-33J8 Sensitive Data Exposure in msrcrypto

Versions of msrcrypto prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography ECC implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no publish...

Android OS WiFi Broadcast Sensitive Data Exposure

Blog post here: https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/ TITLE Sensitive Data Exposure via WiFi Broadcasts in Android OS CVE-2018-9489 SUMMARY System broadcasts by Android OS expose information about the users...

SQL Injection Vulnerability in the Frontend of DaQuanZhouAuto.com

It is an automobile network platform that provides Quanzhou automobile, Quanzhou automobile information, Quanzhou new car, Quanzhou used car and other services. SQL injection vulnerability exists in the front-end of DaQuanZhouAuto.com, the vulnerability stems from the failure to filter the pagenu...

Arbitrary File Traversal Read Delete Vulnerability in Shida Highway Project Management Information System

Servcorp Highway Project Management Information System is an engineering project management platform developed for project participants. The Servcorp Expressway Project Management Information System has an arbitrary file traversal read and delete vulnerability that can be exploited by an attacker...

SQL Injection Vulnerability in Vantage Network's Website Building System

Taixing Jingchuang Network is a company that provides enterprise Internet application services. A SQL injection vulnerability exists in the website builder system of Jingchuang Network, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in MetInfo Website Backend

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A SQL injection vulnerability exists in the backend of MetInfo version 6.1.0 website. An attacker can exploit this vulnerability to obtain sensitive database information...

UBUNTU-CVE-2017-2621

An access-control flaw was found in the OpenStack Orchestration heat service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information...

SQL Injection Vulnerability in Coinsun.com Virtual Currency Trading System

Jinshang China Source Code Forum is a website source code trading platform, providing all kinds of commercial source code. A SQL injection vulnerability exists in the virtual currency trading system of Coinsun.com, which can be exploited by attackers to obtain sensitive database information...

SQL injection vulnerability in ne***.php page of website building system of Beijing Yitianxing Technology Co.

Ltd. is an Internet service provider specializing in providing customized website construction solutions for enterprises. A SQL injection vulnerability exists in the ne.php page of the website building system of Beijing Yitianxing Technology Co. An attacker can use the vulnerability to obtain...

SQL injection vulnerability in Quick Help Cloud enterprise website building system

Quick Help Cloud is a high-quality intellectual property and enterprise information service platform, providing enterprise trademark registration, high-tech enterprise certification, patent application, copyright registration and other intellectual property services. Quick Help Cloud enterprise...

SQL Injection Vulnerability in the Website Building System of Tianjin Enterprises and Businesses Huichuang Technology Co.

Ltd. is a comprehensive network service provider in Tianjin. There is a SQL injection vulnerability in the website building system of Tianjin Enterprises and Businesses Huichuang Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2018-12882)

Edge is Microsoft's browser for Windows 10. Microsoft Edge suffers from an information disclosure vulnerability. The vulnerability stems from Microsoft Edge failing to properly handle objects in memory. An attacker could exploit the vulnerability to obtain information that could further compromis...

CVE-2018-1546

IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

MGASA-2018-0303 Updated ansible packages fix security vulnerability

Ansible prior to 2.4.5 does not honor the nolog task flag for failed tasks. When the nolog flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user...

SAJ Solar Inverter Information Disclosure Vulnerability

SAJ Solar Inverter is a solar inverter product from China's Sanjing Electric Company. An information disclosure vulnerability exists in the SAJ Solar Inverter. A remote attacker can exploit this vulnerability by sending a direct request to the inverterinfo.htm or Englishmain.htm URIs to obtain...

Pulp Information Disclosure Vulnerability

Pulp is a free and open source repository platform for managing content. The platform supports pushing content from software packages to consumers. A security vulnerability exists in Pulp, which stems from the program passing sensitive information to the 'overrideconfig' object when a task is...

VOOKI - Web Application Vulnerability Scanner

Vooki is a free web application vulnerability scanner. Vooki is a user-friendly tool that you can easily scan any web application and find the vulnerabilities. Vooki includes Web Application Scanner, Rest API Scanner, and reporting section. Vooki – Web Application Scanner can help you to find the...

Security Bulletin: Fix available for Sensitive Data Exposure Vulnerability in IBM Cúram Social Program Management (CVE-2016-9978)

Summary IBM Cúram Social Program Management is vulnerable to an already authenticated user bypassing the Security Sensitivity controls via a specially crafted URL. This allows an attacker to view information for certain business objects tagged with higher sensitivity than their current sensitivit...

Security Bulletin: IBM® DB2® contains a sensitive information exposure vulnerability in the monitoring and audit feature (CVE-2014-0919)

Summary IBM DB2 contains a sensitive information exposure vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by executing a series of commands via the monitoring or audit facility to view sensitive data. Vulnerability Details CVEID: CVE-2014-0919 DESCRIPTION: IBM DB2...

Security Bulletin: OpenSSL vulnerabilities in IBM Algo Audit and Compliance (CVE-2016-2108, CVE-2016-2107, CVE-2016-2105, CVE-2016-2106, CVE-2016-2109, CVE-2016-2176)

Summary OpenSSL could allow a remote attacker to execute arbitrary code, obtain sensitive information or perform denial of service attacks. OpenSSL is used by IBM Algo Audit and Compliance. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute...