CVE-2024-34613: Undefined Security Weakness

Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch...

CVE-2024-34788: Improper Authentication

An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information...

MTN Group: SQL injection in URL path leads to Database Access

The application https://corporate.admyntec.co.za/ was found to have an SQL injection vulnerability in its URL paths. User IDs, organization numbers, and other sensitive information were stored in the backend database without proper sanitization, allowing an attacker to exploit the vulnerability a...

SQL Injection Vulnerability in Yisetong Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-36406)

Yisetong electronic document security management system is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal employees from leaking and externa...

UFIDA U8 Cloud suffers from SQL injection vulnerability (CNVD-2024-36940)

U8 Cloud is a digital platform for enterprises to go to the cloud, integrating transactions, services and management into a total ERP solution. A SQL injection vulnerability exists in UFIDA U8 Cloud, which can be exploited by attackers to gain access to sensitive database information...

Kofax Power PDF Out-of-Bounds Read Vulnerability (CNVD-2024-33701)

Kofax Power PDF is a professional PDF editing and management software from Kofax. Kofax Power PDF suffers from an out-of-bounds read vulnerability that can be exploited by attackers to obtain sensitive information...

IBM Sterling Partner Engagement Manager Information Disclosure Vulnerability (CNVD-2024-35115)

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. An information disclosure vulnerability exists in IBM Sterling Partner Engagement Manager version 6.2.2, which can be exploited by a local attacker to gain access to sensitive...

Microsoft Dynamics 365 (on-premises) information disclosure vulnerability (CNVD-2024-34112)

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365...

Apache HTTP Server Information Disclosure Vulnerability (CNVD-2024-36391)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An information disclosure vulnerability exists in Apache HTTP Server, which can be exploited by an attacker to obtain sensitive...

CVE-2024-39251

An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests...

CVE-2024-39846

NewPass before 1.2.0 stores passwords rather than password hashes directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data at rest is encrypted, but is decrypted within process memory during use...

UFIDA U8 Cloud suffers from SQL injection vulnerability (CNVD-2024-33023)

U8 cloud is a new-generation cloud ERP launched by UFIDA, focusing on growing and innovative enterprises and providing enterprise-level cloud ERP solutions. A SQL injection vulnerability exists in UFIDA U8 Cloud, which can be exploited by attackers to obtain sensitive information from the databas...

CVE-2024-33329

A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information...

CVE-2024-33329

LumisXP versions v15.0.x through v16.1.x are vulnerable to authentication bypass due to the use of hard-coded credentials (CWE-798). A hardcoded privileged ID allows an attacker to bypass security controls to access internal pages and other sensitive information. As a temporary workaround, it is ...

CVE-2024-37818

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery SSRF via the component /strapi.io/next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue ...

CVE-2024-37818: Server-Side Request Forgery (SSRF)

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery SSRF via the component /strapi.io/next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue ...

SQL Injection Vulnerability in Xiamen KTO Communication Technology Co., Ltd.'s KTO Fully Intelligent Parking Video Charging System (CNVD-2024-32523)

Xiamen KTO Communication Technology Co., Ltd. is a professional intelligent parking value operator. A SQL injection vulnerability exists in Xiamen KTO Communication Technology Co. Ltd KTO Total Intelligent Parking Video Charging System, which can be exploited by attackers to obtain sensitive...

Trend Micro Apex One Information Disclosure Vulnerability (CNVD-2024-40823)

Trend Micro Apex One is an endpoint protection software from Trend Micro. Trend Micro Apex One suffers from an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information in the system context...

SQL Injection Vulnerability in NC Cloud of UFIDA Network Technology Corporation (CNVD-2024-29454)

NC Cloud is a large enterprise digitalization platform. A SQL injection vulnerability exists in UFIDA Network Technology Corporation NC Cloud, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2024-3404 Improper Access Control in gaizhenbiao/chuanhuchatgpt

In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the history files of other users, potentially leading to...