Private Data Structure Returned From A Public Method

github.com/apache/answer, is vulnerable to Private Data Structure Returned From A Public Method. The vulnerability is due to the application allowing external content to be loaded without restriction, allowing an attacker to track or identify users by collecting their IP addresses through...

Private Data Structure Returned From A Public Method

Overview Affected versions of this package are vulnerable to Private Data Structure Returned From A Public Method. When a user accesses an externally referenced image, the provider of the image may obtain private information about the IP address of that accessing user. Remediation Upgrade...

Private Data Structure Returned From A Public Method

Overview Affected versions of this package are vulnerable to Private Data Structure Returned From A Public Method. When a user accesses an externally referenced image, the provider of the image may obtain private information about the IP address of that accessing user. Remediation Upgrade...

CVE-2025-29868

CVE-2025-29868 affects Apache Answer up to version 1.4.2. A public method returns a private data structure, enabling potential disclosure of a user’s IP address when external images are accessed. The issue is mitigated in version 1.4.5, which adds a configurable setting to control whether externa...

CVE-2024-47061

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the...

The vulnerability in the genie_pptp.cgi script of Netgear router microprogramming systems such as R8500, XR300, R7000P, and R6400 v2 allows a hacker to cause a service failure.

The vulnerability in the geniepptp.cgi script of Netgear router microprogramming devices such as R8500, XR300, R7000P, and R6400 v2 stems from the practice of copying buffers without checking the size of the input data during the processing of the pptpuserip parameter. Exploiting this vulnerabili...

The vulnerability in the wiz_pptp.cgi script of the Netgear R8500, XR300, R7000P, and R6400 v2 router software allows a hacker to cause a service failure.

The vulnerability in the wizpptp.cgi script of Netgear router microprogramming devices such as R8500, XR300, R7000P, and R6400 v2 lies in the copying of buffers without checking the size of the input data during the processing of the pptpuserip parameter. Exploiting this vulnerability allows a...

CVE-2024-52014

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptpuserip parameter at geniepptp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-52015

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptpuserip parameter at bswpptp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-50997

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptpuserip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8254 · NetGear · Netgear R6400 +3

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: The issue is related to a stack overflow vulnerability in the bsw pptp.cgi script of Netgear...

Malicious code in spiderai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

Mozilla: Information disclosure on password cancel endpoint

The password reset cancellation process disclosed the user's IP address in the email sent to the user upon cancellation. This information disclosure vulnerability was exploited to obtain the IP address of a user by tricking them into submitting the password reset cancellation request...

Cross-site Scripting (XSS)

@udecode/plate-core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of custom DOM attributes passed through the attributes property, allowing attackers to inject malicious code via attributes like href and src, or to expose users' IP addresses by causing...

CVE-2023-38059 External pictures can be loaded even if not allowed by configuration

The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; OTRS Community Edition: from 6.0.X through...

OTRS Security Vulnerabilities

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS prior to 7.0.47, versions prior to 8.0.37, and OTRS Community Edition versions 6.0.X through 6.0.34, which stems from a vulnerability that does not prevent an external IMAGE from being...

CVE-2023-30780

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

CVE-2023-30780

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TheGuideX User IP and Location plugin = 2.2 versions...

CVE-2023-30780

CVE-2023-30780 is a stored XSS vulnerability in the WordPress plugin “User IP and Location” by TheGuideX, affecting versions ≤ 2.2. The issue arises from improper handling of user-supplied input, enabling authenticated users with contributor or higher roles to inject script into stored content. I...