CVE-2022-33003

The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

PYSEC-2022-218

The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

KGExplore 安全漏洞

KGExplore is a publicly available knowledge graph exploration project for individual developers. A security vulnerability exists in the KGExplore package for PyPI versions v0.1.1 through v0.1.2. An attacker exploited the vulnerability to access sensitive user information and digital currency keys...

AAmiles 安全漏洞

AAmiles is a machine learning project scanner. AAmiles suffers from a security vulnerability. An attacker exploited the vulnerability to access sensitive user information and digital currency keys, as well as to elevate privileges...

Zibal 安全漏洞

Zibal is the Zibal payment gateway. A security vulnerability exists in Zibal. An attacker could exploit the vulnerability to access sensitive user information and digital currency keys, as well as elevated privileges...

IBM Robotic Process Automation 信息泄露漏洞

IBM Robotic Process Automation is a robotic process automation product from IBM USA. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation suffers from an information disclosure vulnerability that stems from...

PT-2022-18018 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 Description: The issue concerns the handling of environment variables, which has been addressed with improved validation. A user may be able to view sensitive user information due to this issue. Recommendations: F...

ImpressCMS 授权问题漏洞

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to an access control error that could be exploited by remote attackers to bypass implemented security restrictions and obtain...

PT-2022-16769

Name of the Vulnerable Software and Affected Versions Open Web Analytics versions prior to 1.7.4 Description The issue allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files...

CVE-2022-20680

A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive dat...

Improper Authentication in liukuo362573/yishaadmin

Description Hi there yishaadmin maintainer, I would like to report an improper authentication vulnerability in yishaadmin source code. The link /admin/OrganizationManage/User/GetFormJson?id=user-id does not require any authentication and return sensitive user data for anyone like username, gender...

PT-2021-15571 · Rexroth +1 · Indramotion Mlc L20 +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue involves information disclosure where the main configuration, including users and their hashed passwords, is exposed through an unprotected web server resource. This...

ZTE Axon 30 Pro Message Service App 安全漏洞

ZTE Axon 30 Pro Message Service App is a cell phone messaging service app from China's ZTE Corporation ZTE. A security vulnerability exists in the ZTE Axon 30 Pro Message Service App, which can be exploited by an attacker to obtain some sensitive information of a user by accessing a specific page...

CVE-2021-24585

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. Apple iOS and Apple iPadOS contain a security vulnerability that originated when an attacker with a privileged...

Cross site request forgery (csrf)

The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request...

ZTE ZXV10 B860A Information Disclosure Vulnerability

The ZTE ZXV10 B860A is a network set-top box from China's ZTE Corporation ZTE. The ZTE ZXV10 B860A suffers from an information disclosure vulnerability that stems from the device not adequately validating logs, which can be exploited by an attacker to gain access to sensitive user information for...

Information Leakage Vulnerability in Jingyun Network Anti-Virus System of Beijing Tatsun Leader Information Technology Co.

KingCloud Network Antivirus is a private cloud antivirus solution for enterprise-level users. There is an information leakage vulnerability in Jingyun Network Antivirus System of Beijing T&S Leader Information Technology Co., Ltd, which can be exploited by attackers to obtain sensitive user...

Beijing Liangjing Zhicheng Technology Co., Ltd.'s Liangjing Mall Online Shop Shopping System Has Logic Flaws and Vulnerabilities

Liangjing Mall online store shopping system is a set of different types of goods, flexible multi-functional online store system, three-tier distribution PC + mobile + micro-site. Beijing Liangjing Zhicheng Technology Co., Ltd. Liangjing Mall online shopping system has a logic flaw vulnerability...

GitLab: Stored XSS in group issue list

Hello Gitlab! To reproduce the bug, we need to enable the "vueissuableslist" feature in Gitlab. This feature is not enabled by default, but I think it would be better to fix this issue before this feature is permanently available. Steps to reproduce: 1. Run Gitlab docker run --detach --hostname...