Plug n Play Camera com.wisdomcity.zwave 安全漏洞

Plug n Play Camera com.wisdomcity.zwave is a camera driver from Plug n Play. A security vulnerability exists in Plug n Play Camera com.wisdomcity.zwave version 1.1.0, which stems from contains a vulnerability that allows remote attackers to obtain sensitive information through the firmware update...

Shelly com.home.shelly 安全漏洞

Shelly com.home.shelly is a firmware program from Shelly, Inc. A security vulnerability exists in Shelly com.home.shelly version 1.0.4, which stems from a contained vulnerability that allows remote attackers to obtain sensitive information through the firmware update process...

PYSEC-2024-219

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves insecure communication between the FRP Fast Reverse Proxy client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and rea...

CVE-2024-47168 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.6.11 is vulnerable to Sensitive Data Exposure

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.6.11 Fixed in 5.6.12 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8913 Patch priority Low CVSS severity Low 6.5 Developer POSIMYTH Innovations PSID...

WordPress Keep Backup Daily plugin <= 2.1.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Keep Backup Daily versions = 2.1.1...

WordPress Keep Backup Daily Plugin <= 2.1.0 is vulnerable to Sensitive Data Exposure

Software Keep Backup Daily Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A8: Software and Data Integrity Failures Classification Sensitive Data Exposure CVE CVE-2024-48024 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 104015a1054b Credits Joshua Chan...

PT-2024-34: Server Side Request Forgery (SSRF) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...

CVE-2024-33506

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain ADOM to access device summary of unauthorized ADOMs via crafted HTTP...

CVE-2024-47344 WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through = 2.1.5...

CVE-2024-47344 WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StylemixThemes uListing.This issue affects uListing: from n/a through 2.1.5...

PT-2024-32559 · Ulisting · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing versions 2.1.5 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access to it...

CVE-2024-38040

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files...

PT-2024-32850 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: Mediawiki - PageTriage versions 1.39.X through 1.39.8 Mediawiki - PageTriage versions 1.41.X through 1.41.2 Mediawiki - PageTriage versions 1.42.X through 1.42.1 Description: The issue affects the Mediawiki - PageTriage extension, allowing...

The vulnerability of the Next.js software platform for creating web applications lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

Finrota Netahsilat 安全漏洞

Finrota Netahsilat is an online collection system and e-collection program from Finrota, Inc. A security vulnerability exists in Finrota Netahsilat that stems from allowing the extraction of embedded sensitive data...

CVE-2024-7315 Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups...

CVE-2024-7315 Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups...

PYSEC-2024-186

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

Advantech ADAM-5630 Information Disclosure Vulnerability

Advantech ADAM-5630 is an edge intelligent data acquisition controller from Advantech, China. The Advantech ADAM-5630 suffers from an information disclosure vulnerability that is caused by a flaw in sharing user credentials in plain text. An attacker can exploit the vulnerability to obtain...