CVE-2024-6984

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

PT-2024-27711 · Shenzhen Weitillage Industrial Co. · Access Management Specialist

Name of the Vulnerable Software and Affected Versions: Shenzhen Weitillage Industrial Co., Ltd access management specialist version V6.62.51215 Description: An issue in the access management specialist allows a remote attacker to obtain sensitive information. Recommendations: For version...

Monbela Tourist Inn Online Reservation System SQL注入漏洞

Monbela Tourist Inn Online Reservation System is itsourcecode open source an online reservation system for tourists and hotels developed using PHP for storing and retrieving data or any transactions carried out. itsourcecode Monbela Tourist Inn Online Reservation System login.php SQL injection...

SUSE SLES15 / openSUSE 15 Security Update : python-scikit-learn (SUSE-SU-2024:2029-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2029-1 advisory. -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. bsc1226185 Tenable has extracted the preceding description block...

CVE-2024-37307

Summary: CVE-2024-37307 affects Cilium’s cilium-bugtool when run with --envoy-dump against deployments with Envoy enabled. Affected versions: prior to 1.13.7, 1.14.12, and 1.15.6 (i.e., versions 1.13.0–1.13.6, 1.14.0–1.14.11, 1.15.0–1.15.5). Root cause/impact: the tool’s output could contain sens...

PT-2024-14531 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this issue. The specific...

CSS Exfil Protection 安全漏洞

CSS Exfil Protection is a browser plugin from the individual developer Mike Gualtieri. A security vulnerability exists in CSS Exfil Protection version v.1.1.0, which stems from a lack of support for CSS variables and allows an attacker to obtain sensitive information...

PT-2024-25199 · Tvs · Tvs Connect Ios +1

Name of the Vulnerable Software and Affected Versions: TVS Connet Android versions 4.5.1 TVS Connet iOS versions 5.0.0 Description: An issue in TVS Connet allows a remote attacker to obtain sensitive information via an insecure API endpoint. Recommendations: For TVS Connet Android version 4.5.1,...

EulerOS Virtualization 2.11.1 : grub2 (EulerOS-SA-2024-1399)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially...

CVE-2024-29156

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information...

CVE-2023-7072

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'getposts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft...

PT-2024-2147 · Siemens · Sinema Remote Connect Client

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Client versions prior to V3.1 SP1 Description: A vulnerability has been identified in the SINEMA Remote Connect Client, where sensitive information is placed into files or directories that are accessible to actors who ar...

openSUSE: Security Advisory for haproxy (SUSE-SU-2023:0411-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Information disclosure

This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to leak sensitive user information...

CVE-2023-40105

In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40105

CVE-2023-40105 affects the Android framework (ActivityManagerService), specifically in backupAgentCreated. The root cause is a missing permission check in this path, enabling local information disclosure. The impact is high confidentiality loss with no integrity or availability impact described, ...

space-time enterprise information integration platform security vulnerability

The yonyou space-time enterprise information integration platform is an information integration platform from China's UFIDA yonyou company. A security vulnerability exists in Yonyou space-time enterprise information integration platform v.9.0 and earlier versions, which originated from a...

SUSE CVE-2023-33850

IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive...

Medium: ansible-core

Issue Overview: The upstream report describes this issue as follows: When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target fil...