MSC-2024-17262

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...

CVE-2024-53768

CVE-2024-53768 describes an exposure of sensitive system information in the WordPress plugin/content module “Content Audit Exporter” (versions up to 1.1). The issue is categorized as a sensitive information exposure that can allow an unauthorized actor to retrieve embedded sensitive data. Public ...

MSC-2024-17239

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...

MSC-2024-17209

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...

Rakuten Turbo 5G 安全漏洞

Rakuten Turbo 5G is a home router from Rakuten that requires no construction and plugs into an electrical outlet. A security vulnerability exists in Rakuten Turbo 5G V1.3.18 and earlier versions, which arises from the exposure of sensitive system information to unauthorized control, where an...

SoftBank Mesh Wi-Fi router RP562B 安全漏洞

SoftBank Mesh Wi-Fi router RP562B is a router from SoftBank Japan. A security vulnerability exists in SoftBank Mesh Wi-Fi router RP562B v1.0.2 and earlier versions, which stems from the presence of an issue where sensitive system information is exposed to unauthorized sphere of control, and an...

CVE-2024-50528: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through = 5.2.3...

CVE-2024-50425: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through = 2.0.19.10...

CVE-2024-49359

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-49359 ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-49359 ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-49359 ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-48931

ZimaOS (fork of CasaOS) versions 1.2.4 and earlier are affected by an arbitrary file read vulnerability in the API endpoint /v3/file?token=&files=, caused by improper input validation on the files parameter. Authenticated users can manipulate the files value to access sensitive files outside the ...

CVE-2024-48931 ZimaOS Arbitrary File Read via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint http:///v3/file?token=&files= is vulnerable to arbitrary file reading due to improper input validation. By manipulating the files...

CVE-2024-48024

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through = 2.1.3...

CVE-2024-49252

CVE-2024-49252 corresponds to a Broken Access Control / Full Path Disclosure vulnerability in the WordPress Leyka plugin (versions

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Directory Traversal Vulnerability

ABB Cylon Aspect version 3.08.01 has a directory traversal vulnerability that can be exploited by an unauthenticated attacker to list the contents of arbitrary directories without reading file contents, leading to information disclosure of directory structures and filenames. This may expose...

CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions...

Information Exposure

org.apache.pinot, pinot-controllert is vulnerable to Information Exposure. The vulnerability is due to the lack of proper access controls within the "/appconfigs" endpoint, which allows unauthorized users to access sensitive system and environment information...

CVE-2024-31947

CVE-2024-31947 affects StoneFly Storage Concentrator (SC and SCVM) prior to version 8.0.4.26. The vulnerability is a directory traversal flaw triggered by a crafted path parameter used with the Online Help facility, exploitable by authenticated users and potentially exposing sensitive system info...