8101 matches found
CVE-2024-37603
An issue was discovered in Mercedes Benz NTG New Telematics Generation 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the...
Mercedes-Benz NTG security vulnerabilities
Mercedes-Benz NTG is an automobile from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz NTG 6 that originates from an integer overflow in the User-Data Import/Export function. An attacker exploiting this vulnerability could cause the User-Data service to crash...
CVE-2024-37603
An issue was discovered in Mercedes Benz NTG New Telematics Generation 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the...
CVE-2024-37603: Access of Resource Using Incompatible Type
An issue was discovered in Mercedes Benz NTG New Telematics Generation 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the...
CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to modify user data via crafted HTTP requests...
CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to modify user data via crafted HTTP requests...
CVE-2025-26376
CVE-2025-26376 concerns Q-Free MaxTime
CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to modify user data via crafted HTTP requests...
CVE-2024-57178
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...
CVE-2025-26376: Missing Authorization
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to modify user data via crafted HTTP requests...
CVE-2024-12315: Insecure Storage of Sensitive Information
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in t...
OmniGPT AI Chatbot Alleged Breach: Hacker Leaks User Data, 34M Messages
Hacker claims to have breached OmniGPT, leaking over 30,000 user email address, phone numbers, and 34 million lines of chat messages. Data includes API keys, credentials, and file links...
CVE-2025-0589
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly...
CVE-2025-0589
In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly...
CVE-2024-57178
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...
esbuild enables any website to send any requests to the development server and read the response
Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. Details esbuild sets Access-Control-Allow-Origin: header to all requests, including the SSE connection, which allows any websites to send any request to the...
CVE-2024-57178
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...
PT-2025-6099
Name of the Vulnerable Software and Affected Versions Stock-Forecaster versions =01-04-2020 Description A vulnerability exists that allows for SQL injection. By sending a specially crafted stock-symbol parameter to the "portofolio" endpoint, it is possible to trigger an SQL injection in the...
CVE-2024-57178: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...