CVE-2024-53522

Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information...

CVE-2024-11437

CVE-2024-11437 affects Timeline Designer for WordPress. The timeline plugin is vulnerable to SQL Injection via the 's' parameter in all versions up to 1.4 due to insufficient escaping and improper query preparation. This could allow unauthenticated attackers to append additional SQL queries into ...

CVE-2024-53522

Bangkok Medical Software HOSxP XE v4.64.11.3 contains a security vulnerability due to a hardcoded IDEA Key-IV pair within the HOSxPXE4.exe and HOS-WIN32.INI components. This flaw allows a local attacker to decrypt privileged database credentials and access sensitive information. While no official...

CVE-2024-53522

Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information...

XML External Entity (XXE) Injection

simplesamlphp is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of untrusted XML input, which allows attackers to exploit maliciously crafted XML documents, such as SAMLResponse, to access sensitive information or perform other malicious activities...

CVE-2024-48457

Several Netis routers, including models NX10 , NC65 , NC63 , NC21 , and MW5360 , are vulnerable to an out-of-bounds read issue. This flaw allows a remote attacker to obtain sensitive information by targeting the endpoint /cgi-bin/skk_set.cgi and the binary /bin/scripts/start_wifi.sh. Specifically...

CVE-2024-48814

SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function...

Information Leakage Vulnerability in the Commercial Lease Management System of Joyous (Guangzhou) Information Technology Co.

Competitive Excellence Guangzhou Information Technology Ltd. is a company mainly engaged in the manufacturing of computer, communication and other electronic equipment. An information leakage vulnerability exists in the commercial leasing management system of Competitive Excellence Guangzhou...

CVE-2024-48814

SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function...

SQL Injection Vulnerability in Macroview HCM of Beijing Macroview Century Software Co.

Macroview HCM is a human capital management system based on the transformation and upgrading of human resources from management to service operation. A SQL injection vulnerability exists in Hongjing HCM of Beijing Hongjing Century Software Co. Ltd, which can be exploited by attackers to obtain...

CVE-2024-50714

A Server-Side Request Forgery SSRF in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via a crafted script to the /FB/getFbVideoSource.php component...

CVE-2024-55471

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

hornetq-core-client: Arbitrarily overwrite files or access sensitive information

A flaw was found in the createTempFile method of hornetq. Affected version of hornetq allows attackers to arbitrarily overwrite files or access sensitive information...

hornetq-core-client: Arbitrarily overwrite files or access sensitive information

A flaw was found in the createTempFile method of hornetq. Affected version of hornetq allows attackers to arbitrarily overwrite files or access sensitive information...

CVE-2022-33954

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected credentials...

CVE-2022-33954 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected credentials...

CVE-2024-55082

A Server-Side Request Forgery SSRF in the endpoint http://your-server/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensitive information via a crafted request...

XML External Entity

org.http4k, http4k-format-xml is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of malicious XML content in requests, which could allow attackers to access sensitive local information, perform Server-side Request Forgery SSRF, or potentially execute...

CVE-2024-51175

An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component...

Directory Traversal Vulnerability in Smart Data Center Integrated Management Platform of Imicom Technology Group Co.

Imicom Technology Group Co., Ltd. is a company specializing in digital infrastructure full lifecycle solution services. A directory traversal vulnerability exists in the Smart Data Center Integrated Management Platform of Imicom Technology Group Co. and can be exploited by attackers to obtain...