Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata when executing the UpdateChannelBookmark function, due to improper handling of user permissions. By creating a bookmark referencing a deleted file, an attacker can expose metadata from...

Linux Distros Unpatched Vulnerability : CVE-2018-20483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the...

RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...

CVE-2024-1279

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

Code injection

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure

The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata...

CVE-2024-1279

The CVE-2024-1279 vulnerability affects the Paid Memberships Pro WordPress plugin prior to version 2.12.9. The issue allows users with at least the contributor role to disclose other users’ sensitive metadata, exposing confidentiality. Root cause details indicate insufficient access controls for ...

Permissive owner access allows misleading URI changes, impacting user trust.

Lines of code Vulnerability details Impact setUri function is only restricted to the contract owner, this could allow the owner to update the URI and make changes that users did not anticipate. The setUri function allows the owner to update the URI to anything they want. For example, they could...

CVE-2022-3866 Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2...

OpenStack Nova Router metadata queries are not restricted by tenant

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by 1...

CVE-2020-36155

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

WordPress Security Vulnerabilities

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create membership sites or online communities. A security vulnerability...

Information Disclosure

openstack-nova is vulnerable to information disclosure attacks. The vulnerability exists as an interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive...

postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

This release of CloudForms corrects an issue invoked when running pgupgrade by which attackers could read or modify the output of pgdumpall -g in the current working directory. With this release, any attack is rendered infeasible as the directory mode blocks an intruder from searching the current...

postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

This release of CloudForms corrects an issue invoked when running pgupgrade by which attackers could read or modify the output of pgdumpall -g in the current working directory. With this release, any attack is rendered infeasible as the directory mode blocks an intruder from searching the current...

Vulnerability in client (CVE-2018-1053)

pgupgrade creates file of sensitive metadata under prevailing umask...

CVE-2014-3562

Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory...

CVE-2014-2301

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

Buffer overflow

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...

CVE-2014-2301

OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations op=inf to an object in pub/bscw.cgi/...