6930 matches found
CVE-2025-33020
IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information...
CVE-2025-51869
Insecure Direct Object Reference IDOR vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted spaceid, threadid, and messageid parameters to the v1/space/spaceid/thread/threadid/message/messageid endpoint...
Online Appointment Booking System adddoctor.php File SQL Injection Vulnerability
Online Appointment Booking System is an online appointment booking system. Online Appointment Booking System has a SQL injection vulnerability that originates from improper handling of the parameter Username in the file /admin/adddoctor.php, which can be exploited by an attacker to obtain sensiti...
USN-7664-1: Sinatra vulnerabilities
It was discovered that Sinatra incorrectly handled serving static files. An attacker could possibly use this issue to perform local file inclusion, obtaining sensitive information. CVE-2022-29970 It was discovered that Sinatra incorrectly handled special characters in the Content-Disposition HTTP...
CVE-2025-51865
CVE-2025-51865 concerns the Ai2 Playground web service (playground.allenai.org). The vulnerability is an Insecure Direct Object Reference (IDOR) that lets an attacker enumerate thread keys in the URL to gain sensitive information. The CVE is tracked with CVSS 3.1: Network attack, Low attack compl...
DuraComm SPM-500 DP-10iN-100-MU 安全漏洞
The DuraComm SPM-500 DP-10iN-100-MU is a DC power distribution panel from DuraComm USA. A security vulnerability exists in the DuraComm SPM-500 DP-10iN-100-MU that originates from the unencrypted transmission of sensitive data that could be intercepted by an attacker...
CVE-2025-36107
IBM Cognos Analytics Mobile iOS 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data...
CVE-2025-52372
An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components...
CVE-2025-4130 Hardcoded Credentials in PAVO Inc.'s PAVO Pay
Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025...
CVE-2025-52163
A Server-Side Request Forgery SSRF in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure...
CVE-2025-52163
A Server-Side Request Forgery SSRF in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure...
Information Disclosure
Directus is vulnerable to information exposure. The vulnerability is due to logging all incoming request details, including sensitive data like access and refresh tokens when using WebHook triggers in Flows, which allows an attacker with log access to hijack user sessions within the token...
CVE-2025-52163
CVE-2025-52163 affects agorum Software GmbH Agorum core open versions 11.9.2 and 11.10.1, in the TunnelServlet component. A Server-Side Request Forgery (SSRF) allows an attacker to force connections to arbitrary internal and external resources via a crafted request, potentially exposing sensitive...
CVE-2025-52163
A Server-Side Request Forgery SSRF in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure...
CVE-2025-52163
A Server-Side Request Forgery SSRF in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure...
PT-2025-30084 · Agorum Software Gmbh · Agorum Core
Name of the Vulnerable Software and Affected Versions: agorum Software GmbH Agorum core open versions 11.9.2 and 11.10.1 Description: A Server-Side Request Forgery SSRF exists in the TunnelServlet component. This allows attackers to initiate connections to arbitrary internal and external resource...
WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability
Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetSmartFilters versions = 3.6.7...
WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure Vulnerability
Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetWooBuilder versions = 2.1.20...