Improper access control

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp...

U.S. Dept Of Defense: The dashboard is exposed in https://███

Description: At first, hello, after searching in sub-domains, the dashboard was accessed by Google Dorking Which is supposed to be protected https://█████████l/arsys/forms/arpcp/ARPC%3AWeb%3AHier%3ADashboard/Default+Admin+View/?F536871388=1&mode=Submit&cacheid=c66791da References...

UBUNTU-CVE-2022-1650

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2...

CVE-2022-1044

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

Design/Logic Flaw

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

CVE-2022-1044 Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

CVE-2022-1044 Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1...

CVE-2022-1044

The CVE-2022-1044 entry affects the open-source helpdesk/trudesk project (polonel/trudesk) prior to version 1.2.1, where profile images were stored insecurely. The root cause is insecure storage of user profile image data, which can lead to exposure of sensitive information. Multiple connected so...

CVE-2022-29008

An insecure direct object reference IDOR vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information...

Microsoft Windows Print Spooler Components 信息泄露漏洞

An information disclosure vulnerability exists in Microsoft Windows Print Spooler Components, a print backend processor component of Microsoft Corporation. The vulnerability stems from a configuration or other error in the operation of the network system or product. An attacker could use this...

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

CVE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

CVE-2021-38693

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the...

GHSA-J77R-2FXF-5JRW Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...

CVE-2022-20764 Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service DoS condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destinatio...

CVE-2021-42001

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP...

CVE-2021-42001

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP...

PT-2022-11528 · Ping Identity · Pingid Desktop

Name of the Vulnerable Software and Affected Versions: PingID Desktop versions prior to 1.7.3 Description: The issue is related to a misconfiguration in the encryption libraries of PingID Desktop, which can lead to sensitive data exposure. An attacker capable of exploiting this issue may be able ...

CVE-2021-29776

IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030...

The vulnerability of the Libraries component of Java SE software platforms, specifically the Oracle GraalVM Enterprise Edition virtual machine, allows attackers to disclose protected information.

The vulnerability of the Libraries component in Java SE software platforms, specifically within the Oracle GraalVM Enterprise Edition virtual machine, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose protected information...