Overview 687 matches · 53 in Waratek scope · 1 protected · 6 exploited · 3 CISA KEV · 16 public PoC · 6 EPSS ≥ 0.5
687matches
53in Waratek scope7.7%
1protected0.1%
6exploited0.9%
3CISA KEV0.4%
16public PoC2.3%
6EPSS ≥ 0.50.9%
Protected by Waratek
1
0.1%
Rule in development
0
0.0%
Mitigation candidate
2
0.3%
No exploit published
50
7.3%
Outside Waratek scope
7
1.0%
Not applicable
627
91.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.1%
partly blocked
0
0.0%
not blocked
686
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 192 / year
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20022
No exploit published2
Medium2
not blocked2
No public exploit2
20030
20040
20050
20060
20070
20080
20090
20101
Not applicable1
Medium1
not blocked1
Exploited1
20110
20120
20130
20142
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Exploited1
No public exploit1
20150
20160
20175
Not applicable5
Critical2
Medium3
not blocked5
No public exploit5
201813
Protected by Waratek1
No exploit published2
Not applicable10
Critical2
High3
Medium7
Low1
blocked by ARMR today1
not blocked12
Working exploit published1
No public exploit12
201940
No exploit published2
Not applicable38
Critical2
High7
Medium29
Low2
not blocked40
No public exploit40
202061
No exploit published3
Outside Waratek scope1
Not applicable57
High8
Medium44
Low9
not blocked61
Working exploit published1
No public exploit60
202170
Mitigation candidate1
No exploit published3
Outside Waratek scope3
Not applicable63
High7
Medium55
Low8
not blocked70
Working exploit published2
Proof of concept only1
No public exploit67
202251
No exploit published3
Not applicable48
Critical4
High13
Medium31
Low3
not blocked51
Working exploit published1
Proof of concept only3
No public exploit47
202373
No exploit published4
Outside Waratek scope1
Not applicable68
Critical12
High15
Medium44
Low2
not blocked73
Exploited1
Proof of concept only15
No public exploit57
202475
Mitigation candidate1
No exploit published6
Not applicable68
Critical2
High13
Medium54
Low5
Unknown1
not blocked75
Exploited1
Working exploit published2
Proof of concept only6
No public exploit66
2025101
No exploit published5
Outside Waratek scope1
Not applicable95
Critical4
High13
Medium69
Low15
not blocked101
Exploited2
Proof of concept only10
No public exploit89
2026192
No exploit published20
Not applicable172
Critical5
High30
Medium136
Low21
not blocked192
Working exploit published1
Proof of concept only39
No public exploit152
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-41076 | Medium | 2025-11-20 | Not applicable | No public exploit | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker. |
| CVE-2025-9977 | Medium | 2025-11-18 | Not applicable | No public exploit | Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms. Additionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. Patching status is unknown because the vendor has not replied to messages sent by the CNA. |
| CVE-2025-54562 | Medium | 2025-11-14 | Not applicable | No public exploit | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed through stack trace. |
| CVE-2025-64749 | Medium | 2025-11-13 | Not applicable | No public exploit | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an existing collection which they are not authorized to access, and when user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. Version 11.13.0 fixes the issue. |
| CVE-2025-40760 | Medium | 2025-11-11 | Not applicable | No public exploit | A vulnerability has been identified in Altair Grid Engine (All versions < V2026.0.0). Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests. This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks. |
| CVE-2025-61959 | Medium | 2025-10-29 | Not applicable | No public exploit | Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers. |
| CVE-2025-12365 | Medium | 2025-10-27 | Not applicable | No public exploit | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-62397 | Medium | 2025-10-23 | Not applicable | No public exploit | The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. |
| CVE-2025-62168 | Critical | 2025-10-17 | Not applicable | Exploited | Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off. |
| CVE-2025-55676 | Medium | 2025-10-14 | Not applicable | No public exploit | Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally. |
| CVE-2025-31998 | Critical | 2025-10-12 | Not applicable | No public exploit | HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service. |
| CVE-2025-54291 | Medium | 2025-10-02 | Not applicable | Proof of concept only | Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. |
| CVE-2025-26333 | High | 2025-09-25 | Not applicable | No public exploit | Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potentially exploit this vulnerability, leading to information exposure. |
| CVE-2025-59016 | Medium | 2025-09-09 | Not applicable | No public exploit | Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations. |
| CVE-2025-53803 | Medium | 2025-09-09 | Not applicable | No public exploit | Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. |
| CVE-2025-43777 | Medium | 2025-09-09 | No exploit published | No public exploit | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret. |
| CVE-2025-43776 | Medium | 2025-09-09 | No exploit published | No public exploit | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping. |
| CVE-2025-48562 | Medium | 2025-09-04 | Not applicable | No public exploit | In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2025-22421 | Medium | 2025-09-02 | Not applicable | No public exploit | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-36003 | High | 2025-08-28 | Not applicable | No public exploit | IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system. |
| CVE-2025-9229 | Medium | 2025-08-20 | Not applicable | No public exploit | Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages. |
| CVE-2025-9005 | Low | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. |
| CVE-2025-52619 | Medium | 2025-08-15 | Not applicable | No public exploit | HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform. |
| CVE-2025-54791 | Medium | 2025-08-13 | Not applicable | No public exploit | OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property. |
| CVE-2024-41984 | Low | 2025-08-12 | Not applicable | No public exploit | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application improperly handles error while accessing an inaccessible resource leading to exposing the system applications. |
| CVE-2024-41983 | Medium | 2025-08-12 | Not applicable | No public exploit | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application displays SQL statement in the error messages encountered during the generation of reports using Cockpit tool. |
| CVE-2025-8852 | Low | 2025-08-11 | Not applicable | Proof of concept only | A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-23320 | High | 2025-08-06 | Not applicable | No public exploit | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request. A successful exploit of this vulnerability might lead to information disclosure. |
| CVE-2025-8548 | Low | 2025-08-05 | Not applicable | Proof of concept only | A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue. |
| CVE-2025-46658 | Critical | 2025-08-05 | Not applicable | No public exploit | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages. |
| CVE-2025-47813 | Medium | 2025-07-10 | Not applicable | Exploited | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
| CVE-2025-36090 | Medium | 2025-07-10 | Not applicable | No public exploit | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message. |
| CVE-2024-37524 | Medium | 2025-07-10 | Not applicable | No public exploit | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. |
| CVE-2025-40718 | Medium | 2025-07-08 | Not applicable | No public exploit | Improper error handling vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to send malformed payloads to generate error messages containing sensitive information. |
| CVE-2025-5731 | Medium | 2025-06-26 | No exploit published | No public exploit | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found. |
| CVE-2025-44203 | High | 2025-06-20 | Not applicable | Proof of concept only | In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8. |
| CVE-2025-49128 | Medium | 2025-06-06 | No exploit published | Proof of concept only | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage. |
| CVE-2024-56342 | Medium | 2025-06-06 | Not applicable | No public exploit | IBM Verify Identity Access Digital Credentials 24.06 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2025-25025 | Medium | 2025-05-28 | Not applicable | No public exploit | IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2025-41441 | Medium | 2025-05-26 | Not applicable | No public exploit | Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature. |
| CVE-2025-40653 | Medium | 2025-05-26 | Not applicable | No public exploit | User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames. |
| CVE-2025-46746 | Medium | 2025-05-12 | Not applicable | No public exploit | An administrator could discover another account's credentials. |
| CVE-2025-4166 | Medium | 2025-05-02 | Not applicable | No public exploit | Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. |
| CVE-2025-0049 | Medium | 2025-04-28 | Not applicable | No public exploit | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0. |
| CVE-2025-46575 | High | 2025-04-27 | Not applicable | No public exploit | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information. |
| CVE-2025-25045 | Medium | 2025-04-23 | Not applicable | No public exploit | IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system. |
| CVE-2025-20150 | Medium | 2025-04-16 | Outside Waratek scope | No public exploit | A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow an attacker to determine which usernames are valid LDAP user accounts. |
| CVE-2024-11129 | High | 2025-04-10 | Not applicable | No public exploit | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term." |
| CVE-2025-32238 | Medium | 2025-04-04 | Not applicable | No public exploit | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5. |
| CVE-2025-0279 | Medium | 2025-04-03 | Not applicable | No public exploit | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks. |
| CVE-2023-47639 | Medium | 2025-04-03 | Not applicable | Proof of concept only | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5. |
| CVE-2024-55895 | Medium | 2025-03-29 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2025-31141 | High | 2025-03-27 | Not applicable | No public exploit | In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
| CVE-2024-12380 | High | 2025-03-13 | Not applicable | No public exploit | An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information. |
| CVE-2025-2239 | Medium | 2025-03-12 | Not applicable | No public exploit | Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23. |
| CVE-2025-23185 | Medium | 2025-03-11 | Not applicable | No public exploit | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application. |
| CVE-2025-20002 | Medium | 2025-03-05 | Not applicable | No public exploit | After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure |
| CVE-2024-56812 | Medium | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56811 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56810 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56496 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56495 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56494 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56493 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2025-0941 | Medium | 2025-02-26 | Not applicable | No public exploit | MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users. |
| CVE-2024-13537 | Medium | 2025-02-21 | Not applicable | No public exploit | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin containing a publicly accessible composer-setup.php file with error display enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2024-13540 | Medium | 2025-02-18 | Not applicable | No public exploit | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodt_get_all_orders.php file being publicly accessible and generating a publicly visible error message. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2024-13538 | Medium | 2025-02-18 | Not applicable | No public exploit | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2024-13535 | Medium | 2025-02-18 | Not applicable | No public exploit | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-setup.php file being publicly accessible with 'display_errors' set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2024-13539 | Medium | 2025-02-12 | Not applicable | No public exploit | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-interface/phpunit.php file being publicly accessible and displaying error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2024-52611 | Low | 2025-02-11 | Not applicable | No public exploit | The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions. |
| CVE-2024-56467 | Low | 2025-02-06 | Not applicable | Proof of concept only | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-49798 | Medium | 2025-02-06 | Not applicable | No public exploit | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-45659 | Medium | 2025-02-04 | Not applicable | No public exploit | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-45658 | Medium | 2025-02-04 | Not applicable | No public exploit | IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2025-23216 | Medium | 2025-01-30 | Not applicable | No public exploit | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13. |
| CVE-2025-22218 | High | 2025-01-30 | Not applicable | No public exploit | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs |
| CVE-2024-35134 | Medium | 2025-01-25 | Not applicable | No public exploit | IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-35112 | Medium | 2025-01-25 | Not applicable | No public exploit | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-35111 | Medium | 2025-01-25 | Not applicable | No public exploit | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2023-38716 | High | 2025-01-25 | Not applicable | No public exploit | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system. |
| CVE-2023-38714 | High | 2025-01-25 | Not applicable | No public exploit | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. |
| CVE-2023-38713 | High | 2025-01-25 | Not applicable | No public exploit | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. |
| CVE-2025-24552 | Medium | 2025-01-24 | Not applicable | No public exploit | Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11. |
| CVE-2024-13536 | Medium | 2025-01-21 | Not applicable | No public exploit | The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. |
| CVE-2025-0053 | Medium | 2025-01-14 | Not applicable | No public exploit | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits. |
| CVE-2024-52898 | Medium | 2025-01-14 | Not applicable | No public exploit | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-52893 | Medium | 2025-01-07 | Not applicable | No public exploit | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-25037 | Medium | 2025-01-07 | Not applicable | No public exploit | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. |
| CVE-2024-11625 | High | 2025-01-07 | Not applicable | No public exploit | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. |
| CVE-2022-22363 | Medium | 2025-01-07 | Not applicable | No public exploit | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2021-20455 | Low | 2025-01-07 | Not applicable | No public exploit | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-5591 | Medium | 2025-01-03 | Not applicable | No public exploit | IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-39725 | Medium | 2024-12-25 | Not applicable | No public exploit | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-23945 | Medium | 2024-12-23 | No exploit published | No public exploit | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12 |
| CVE-2024-52897 | Medium | 2024-12-19 | Not applicable | No public exploit | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-52896 | Medium | 2024-12-19 | Not applicable | No public exploit | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-49818 | Medium | 2024-12-17 | Not applicable | No public exploit | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-54366 | Medium | 2024-12-16 | Not applicable | No public exploit | Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through <= 2.4.4. |
| CVE-2024-51460 | Medium | 2024-12-11 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. |