#cwe-200

共收录 1929 条相关情报。

漏洞预警2025-10-28 发布HIGH

An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the "pre-resource" option in bes-web.xml.

CVE-2025-60805

An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-27 发布HIGH

TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive inte...

CVE-2025-27225

TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unau

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-27 发布HIGH

Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentica...

CVE-2025-61482

Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local a

来源摘录 · NVD

#cve #cwe-200 #cwe-522 #cwe-922

漏洞预警2025-10-27 发布HIGH

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.

CVE-2025-52268

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to for

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-27 发布CRITICAL

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected J...

CVE-2025-61481

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by de

来源摘录 · NVD

#cve #cwe-1188 #cwe-200 #cwe-319

漏洞预警2025-10-23 发布MEDIUM

An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situations, including loc...

CVE-2025-54966

An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return s

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-23 发布MEDIUM

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group info...

CVE-2025-62400

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden g

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-21 发布HIGH

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal inf...

CVE-2025-61220

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-03 发布MEDIUM

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This secu...

CVE-2025-60449

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.p

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-02 发布HIGH

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute De...

CVE-2025-59405

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and S

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-10-02 发布HIGH

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field...

CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-26 发布HIGH

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-26 发布MEDIUM

Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.

CVE-2025-56463

Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-22 发布CRITICAL

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connection, the attacker ...

CVE-2025-57441

The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Te

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-22 发布CRITICAL

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extens...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-22 发布MEDIUM

The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/ajax_request/get_d...

CVE-2025-57433

The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POS

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-09-22 发布HIGH

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration includin...

CVE-2025-57430

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When access

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-06-17 发布LOW

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full ...

CVE-2025-6199

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompressio

来源摘录 · NVD

#cve #cwe-200

漏洞预警2025-06-17 发布MEDIUM

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previo...

CVE-2025-49177

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length

来源摘录 · NVD

#cve #cwe-200

漏洞预警2024-09-20 发布LOW

A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / v...

CVE-2024-8612

A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set

来源摘录 · NVD

#cve #cwe-200