85557 matches found
LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure
The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.1 through the debug.log file that is publicly exposed. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...
XWiki < 4.10.15 - Sensitive Information Disclosure
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...
Weaver OA 9.5 - Information Disclosure
A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. id:...
Oracle Business Intelligence - Path Traversal
Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...
Wipro Holmes Orchestrator 20.4.1 - Information Disclosure
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
Lotus Domino R5 and R6 WebMail - Information Disclosure
Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...
WP Helper Lite < 4.3 - Cross-Site Scripting
The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. id: CVE-2023-0448 info: name: WP Helper Lite 4.3 - Cross-Site Scripting author: ritikchaddha severity: medium description: | T...
ManageEngine ADManager Plus - Command Injection
Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings. id: CVE-2023-29084 info: name: ManageEngine ADManager Plus - Command Injection author: rootxharsh,iamnoooob,pdresearch severity: high description: | Zoho ManageEngine...
EUVD-2026-63708
An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...
PT-2026-79239
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read...
PT-2026-79165
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication...
CVE-2025-36254
CVE-2025-36254 affects the Hardware Management Console (HMC) component of IBM System Storage DS8A00 (10.1.3.0–10.11.35.0) and IBM DS8900F (89.40.83.0–89.44.25.0). The root cause is improper encoding of DSCLI command output (CWE-116), which allows an unauthenticated remote attacker to bypass secur...
CVE-2025-36254 DS8900F and DS8A00 Authentication Bypass
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service...
CVE-2026-17015 IBM i Denial of Service
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read...
CVE-2026-17015
IBM i versions 7.3 through 7.6 (feature 5770-SS1) suffer a CWE-125 out-of-bounds read, exploitable by a remote authenticated attacker to cause denial of service and leak sensitive information (CVSS 5.4 Medium). IBM provides PTFs: SJ11150 (7.6), SJ11149 (7.5), SJ11148 (7.4), SJ11147 (7.3); no work...
CVE-2026-16838
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2026-16891
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are affected by CWE-125 out-of-bounds read in the bos.mp64 kernel fileset, allowing a local attacker to obtain sensitive information (CVSS 3.3, LOW). IBM has released APARs (IJ59566–IJ59563) available via Service Packs/SP13–SP02 for AIX and Fix Packs 4.1.0.50–...
CVE-2026-16890 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow...