363 matches found
NotQuite0DayFriday
This repository documents real bugs in real software. At the time of disclosure the most recent versions were patched. Seeing mistakes that were made in the past can be a useful tool for seeing trends of bugs which make it past all the quality control processes. Understanding what happened, is th...
EUVD-2026-112031
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further...
CVE-2026-67080 HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further...
CVE-2026-84180
A flaw was found in Apache Camel's Knative component. When message processing fails, the Knative HTTP consumer returns detailed exception information, including class names, messages, and stack traces, directly in the response body to the caller. A remote attacker could exploit this flaw by sendi...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the checkFailure function in the CXF SOAP consumer. An external caller can read internal class and package names and exception messages by sending a SOAP request that triggers an undeclared route failure; if CXF...
Apache Camel information leakage vulnerability
Apache Camel versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises because the CXF component, when handling exceptions that are not declared by the SOAP consumer, returns exception messages and stac...
Apache Camel information leakage vulnerability
Versions of Apache Camel from 4.0.0 to 4.18.5, as well as from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the Knative HTTP consumer, during processing failures, returns exception messages containing class names, messages, and stack traces...
BIT-RCLONE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
PT-2026-99016
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
pentest-moodle-fiusac
Pentest Moodle FIUSAC — Divulgación de información por depurac...
CVE-2026-92962
A flaw was found in vm2, a sandbox for running untrusted JavaScript. Malicious code running within the sandbox can exploit a weakness in how stack traces are handled. By manipulating the Array.prototype, an attacker can observe and intercept individual lines of stack traces, leading to an...
PT-2026-84162
An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...
EUVD-2026-67012
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...
CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...
CVE-2026-79777
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
UBUNTU-CVE-2026-79777
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
CVE-2026-79777
rclone versions before v1.75.0 include full Go stack traces in RC API error responses when panics occur. An authenticated attacker (high privileges required) can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses. The CVSS 3.1 base score is 2.7 (LO...
CVE-2026-79777: Generation of Error Message Containing Sensitive Information
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
EUVD-2026-54569
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...
CVE-2026-47364
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...