6940 matches found
CVE-2021-4377 Doneren met Mollie <= 2.8.4 - Information Disclosure
The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmmexportdonations function which is called via the adminpostdmmexport hook due to missing capability checks. This can allow authenticated attackers to extract a CS...
CVE-2020-36723 ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...
CVE-2020-36723
CVE-2020-36723 affects ListingPro — WordPress Directory & Listing Theme. Versions prior to 2.6.1 are vulnerable to sensitive data exposure via the ~/listingpro-plugin/functions.php file, allowing unauthenticated attackers to extract usernames, full names, email addresses, phone numbers, physical ...
CVE-2020-36723 ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...
Medium: cloud-init
Issue Overview: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Affected Packages: cloud-init Issue Correction: Run dnf update cloud-init --releasever...
Design/Logic Flaw
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 EU on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the...
Fuji Electric FRENIC RHC Loader 代码问题漏洞
Fuji Electric FRENIC RHC Loader is a software tool developed by Fuji Electric Japan for debugging and monitoring inverters, mainly serving the industrial automation field. The Fuji Electric FRENIC RHC Loader suffers from an XML external entity reference vulnerability that can be exploited by an...
Design/Logic Flaw
The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.1 via a shortcode attribute. This allows editor-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files...
PT-2023-19041 · Stormshield · Stormshield Endpoint Security
Name of the Vulnerable Software and Affected Versions: Stormshield Endpoint Security versions 2.3.0 through 2.3.2 Description: The issue allows authenticated users to read sensitive information due to incorrect access control. Recommendations: For versions 2.3.0 through 2.3.2, update to a version...
CVE-2023-23304
The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the Toybox.SensorHistory module without permission. A malicious application could call any functions from the Toybox.SensorHistory module without the user's consent a...
USN-6042-2: Cloud-init regression
USN-6042-1 fixed a vulnerability in Cloud-init. The update introduced a regression on Ubuntu 20.04 LTS resulting in a possible loss of networking. This update fixes the problem. We apologize for the inconvenience. Original advisory details: James Golovich discovered that sensitive data could be...
CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin...
Command injection
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin...
CVE-2022-46738
CVE-2022-46738 affects Dataprobe iBoot-PDU FW prior to 1.43.03312023. The vulnerability is categorized as an OS command/credential issue tied to weak credentials that enables an attacker to use SNMP to retrieve the device MAC address and log in as the administrator, exposing sensitive information...
CVE-2022-46738 CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin...
WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Sensitive Data Exposure
Software EventPrime Type Plugin Vulnerable versions = 2.8.6 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-33321 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 71ae7af08f1a Credits yuyudhn Required privilege...
PT-2023-21700 · Snap One · Snap One Ovrc
Name of the Vulnerable Software and Affected Versions: Snap One OvrC affected versions not specified Description: The issue allows an attacker to enumerate device MAC addresses and obtain information about the devices from the Snap One OvrC cloud servers. When a random MAC address is provided, th...
Dataprobe iBoot-PDU 安全漏洞
The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A security vulnerability exists in Dataprobe iBoot-PDU FW prior to version 1.42.06162022, which stems from the product exposing multiple sensitive data fields, and can be exploited by an...
CVE-2023-28045
Dell CloudIQ Collector version 1.10.2 contains a missing encryption of sensitive data vulnerability. An attacker with low privileges could potentially exploit this vulnerability, leading to gain access to unauthorized data...