445 matches found
CVE-2024-47775
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parseds64 function within gstwavparse.c. The parseds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multipl...
PT-2024-10476
Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read in the gst wavparse cue chunk function within gstwavparse.c. This occurs due to a discrepancy between the size of the data buffer and the size value...
gRPC: sensitive information disclosure
A flaw was found in gRPC. This flaw allows a remote attacker to obtain sensitive information, caused by a flaw when the gRPC HTTP2 stack raised a header size exceeded error. By sending a specially crafted request, an attacker can obtain sensitive information, and use this information to launch...
CVE-2024-11702
Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox 133 and Thunderbird 133...
PT-2024-34374 Ā· Unknown Ā· Python Food Ordering System
Name of the Vulnerable Software and Affected Versions: python food ordering system version V1.0 Description: The python food ordering system has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through the...
PT-2024-10125
The rsync daemon is affected by a flaw that can be triggered when comparing file checksums, allowing an attacker to manipulate the checksum length and cause a comparison between a checksum and uninitialized memory. This results in the leak of one byte of uninitialized stack data at a time. An...
CVE-2024-49357
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...
CVE-2024-49357
CVE-2024-49357 affects ZimaOS (a CasaOS fork) on Zima devices and x86-64 with UEFI. Versions 1.2.4 and earlier expose sensitive data through unauthenticated API endpoints, e.g. /v1/users/image?path=/var/lib/casaos/1/app_order.json and /var/lib/casaos/1/system.json, enabling attackers to view inst...
CVE-2024-49357 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...
CVE-2023-50355
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack...
Local File Inclusion (LFI)
phpoffice/phpspreadsheet is vulnerable to Local File Inclusion LFI. The vulnerability is due to PhpSpreadsheet retrieving image sizes and types by reading the contents of files from external URLs, allowing attackers to exploit php://filter URLs to leak sensitive file contents or data from arbitra...
PT-2024-9617
Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read vulnerability in the parse ds64 function within gstwavparse.c. This vulnerability allows reading beyond the bounds of the data buffer, potentially...
PT-2024-10886 Ā· Opentext Ā· Opentext Edirectory
Name of the Vulnerable Software and Affected Versions: OpenText eDirectory version 9.2.4.0000 Description: A Possible Insertion of Sensitive Information into Log File issue has been discovered in eDirectory. This issue affects the logging mechanism, potentially allowing sensitive information to b...
CVE-2021-22509
A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authentication before 6.3.5.1...
Mozilla Firefox < 129.0
The version of Firefox installed on the remote Windows host is prior to 129.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-33 advisory. - Incorrect garbage collection interaction could have led to a use-after-free. CVE-2024-7530 - Insufficient checks when...
Mozilla Thunderbird < 115.14
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-38 advisory. - Unexpected marking work at the start of sweeping could have led to a use-after-free. CVE-2024-7527 -...
Security Vulnerabilities fixed in Firefox ESR 128.1 ā Mozilla
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape....
GHSA-6VJM-54VP-MXHX Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If...
APM Server 8.14.0 Security Update (ESA-2024-19)
APM Server Insertion of Sensitive Information into Log File ESA-2024-19 APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailableshardsexception for a specific document, since the ES response line contains the document body, and that APM...
CVE-2024-6984
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm...