Overview 222 matches · 4 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
222matches
4in Waratek scope1.8%
0protected0.0%
1exploited0.5%
0CISA KEV0.0%
4public PoC1.8%
1EPSS ≥ 0.50.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.5%
No exploit published
3
1.4%
Outside Waratek scope
0
0.0%
Not applicable
218
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
222
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 86 / year
20173
Not applicable3
Medium3
not blocked3
No public exploit3
20180
20199
Not applicable9
Medium9
not blocked9
No public exploit9
20209
Mitigation candidate1
Not applicable8
Medium9
not blocked9
Working exploit published1
Proof of concept only1
No public exploit7
202115
Not applicable15
Medium15
not blocked15
No public exploit15
202215
Not applicable15
Medium15
not blocked15
Working exploit published2
No public exploit13
202318
Not applicable18
Medium18
not blocked18
Exploited1
Proof of concept only2
No public exploit15
202486
No exploit published3
Not applicable83
Medium86
not blocked86
Proof of concept only7
No public exploit79
202552
Not applicable52
Medium52
not blocked52
Proof of concept only26
No public exploit26
202615
Not applicable15
Medium15
not blocked15
Proof of concept only3
No public exploit12
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-109582 | Medium | 2026-11-09 | Not applicable | No public exploit | Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained. |
| CVE-2026-84283 | Medium | 2026-09-25 | Not applicable | Proof of concept only | Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder. |
| CVE-2026-77875 | Medium | 2026-09-19 | Not applicable | No public exploit | The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode. |
| CVE-2025-59320 | Medium | 2026-08-12 | Not applicable | No public exploit | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM. |
| CVE-2026-20705 | Medium | 2026-08-11 | Not applicable | No public exploit | Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts. |
| CVE-2026-47362 | Medium | 2026-08-07 | Not applicable | No public exploit | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in plaintext. |
| CVE-2026-5515 | Medium | 2026-05-27 | Not applicable | No public exploit | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user. |
| CVE-2025-32751 | Medium | 2026-05-22 | Not applicable | No public exploit | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. |
| CVE-2025-32746 | Medium | 2026-05-22 | Not applicable | No public exploit | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. |
| CVE-2026-7257 | Medium | 2026-05-12 | Not applicable | No public exploit | ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file. |
| CVE-2026-5666 | Medium | 2026-04-06 | Not applicable | Proof of concept only | A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used. |
| CVE-2026-5650 | Medium | 2026-04-06 | Not applicable | Proof of concept only | A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used. |
| CVE-2025-10734 | Medium | 2026-03-23 | Not applicable | No public exploit | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses. |
| CVE-2026-20629 | Medium | 2026-02-11 | Not applicable | No public exploit | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data. |
| CVE-2025-10464 | Medium | 2026-02-09 | Not applicable | No public exploit | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology. |
| CVE-2025-60856 | Medium | 2025-10-20 | Not applicable | No public exploit | Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE: this is disputed by the Supplier because of "certain restrictions on users privately connecting serial port cables" and because "the root user has a password and it meets the requirements of password security complexity." |
| CVE-2025-11639 | Medium | 2025-10-12 | Not applicable | Proof of concept only | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An attack has to be approached locally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-21045 | Medium | 2025-10-10 | Not applicable | No public exploit | Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. |
| CVE-2025-35054 | Medium | 2025-10-09 | Not applicable | No public exploit | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources. |
| CVE-2025-34189 | Medium | 2025-09-19 | Not applicable | No public exploit | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security. |
| CVE-2025-43203 | Medium | 2025-09-15 | Not applicable | No public exploit | The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An attacker with physical access to an unlocked device may be able to view an image in the most recently viewed locked note. |
| CVE-2025-54083 | Medium | 2025-09-09 | Not applicable | Proof of concept only | Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. |
| CVE-2025-21041 | Medium | 2025-09-03 | Not applicable | No public exploit | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
| CVE-2025-25732 | Medium | 2025-08-26 | Not applicable | No public exploit | Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root. |
| CVE-2025-46660 | Medium | 2025-08-06 | Not applicable | No public exploit | An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt. |
| CVE-2025-37110 | Medium | 2025-07-31 | Not applicable | No public exploit | A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information. |
| CVE-2025-28171 | Medium | 2025-07-29 | Not applicable | Proof of concept only | An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi. |
| CVE-2025-42979 | Medium | 2025-07-08 | Not applicable | No public exploit | The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user�s windows registry could recreate the original password. There is no impact on integrity or availability of the application |
| CVE-2025-21003 | Medium | 2025-07-08 | Not applicable | No public exploit | Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information. |
| CVE-2024-13954 | Medium | 2025-05-22 | Not applicable | No public exploit | Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. |
| CVE-2025-2440 | Medium | 2025-04-09 | Not applicable | No public exploit | CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode. |
| CVE-2025-20945 | Medium | 2025-04-08 | Not applicable | No public exploit | Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
| CVE-2025-2489 | Medium | 2025-03-18 | Not applicable | No public exploit | Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json. |
| CVE-2025-20912 | Medium | 2025-03-06 | Not applicable | No public exploit | Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch. |
| CVE-2025-21098 | Medium | 2025-03-04 | Not applicable | No public exploit | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check. |
| CVE-2025-22492 | Medium | 2025-02-28 | Not applicable | No public exploit | The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.100 of FRS. |
| CVE-2025-20886 | Medium | 2025-02-04 | Not applicable | No public exploit | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
| CVE-2025-24117 | Medium | 2025-01-27 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, visionOS 2.3, watchOS 11.3. An app may be able to fingerprint the user. |
| CVE-2025-24101 | Medium | 2025-01-27 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data. |
| CVE-2024-56972 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56971 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56969 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56968 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. |
| CVE-2024-56967 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56966 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56965 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56964 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56963 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56962 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56960 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56959 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56957 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56955 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56954 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56953 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. |
| CVE-2024-56952 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link. |
| CVE-2024-56951 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56950 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56949 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56948 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-56947 | Medium | 2025-01-27 | Not applicable | Proof of concept only | An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. |
| CVE-2024-55931 | Medium | 2025-01-27 | Not applicable | No public exploit | Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin. |
| CVE-2024-54728 | Medium | 2025-01-27 | Not applicable | Proof of concept only | Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. |
| CVE-2024-54549 | Medium | 2025-01-27 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. |
| CVE-2024-54541 | Medium | 2025-01-27 | Not applicable | No public exploit | This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. An app may be able to access user-sensitive data. |
| CVE-2021-42718 | Medium | 2025-01-23 | Not applicable | No public exploit | Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800. This CVE was originally reserved in 2021 and later publicly disclosed by Replicated on their website on 21 October 2021. However, it mistakenly remained in the Reserved But Public (RBP) status with the CVE Numbering Authority (CNA). Please note that this product reached its end of life on 31 December 2024. Publishing this CVE with the CNA was required to comply with CNA rules, despite the fact that the issue was disclosed and fixed four years ago, and the affected product is no longer supported as of 2024. Summary of VulnerabilityThis advisory discloses a low severity security vulnerability in the versions of Replicated Classic listed above (“Affected Replicated Classic Versions”) DescriptionReplicated Classic versions prior to 2.53.1 have an authenticated API from the Replicated Admin Console that may expose sensitive data including application secrets, depending on how the application manifests are written. A user with valid credentials and access to the Admin Console port (8800) on the Replicated Classic server can retrieve container definitions including environment variables which may contain passwords and other secrets depending on how the application is configured. This data is shared over authenticated sessions to the Admin Console only, and was never displayed or used in the application processing. To remediate this issue, we removed the sensitive data from the API, sending only the data to the Admin Console that was needed. TimelineThis issue was discovered during a security review on 16 September 2021. Patched versions were released on 23 September 2021. This advisory was published on 21 October 2021. The CVE Numbering Authority (CNA) notified Replicated on 23 January 2025 that the CVE was still in Reserved But Public (RBP) status. Upon discovering the oversight in updating the status to published with the CNA, Replicated submitted the updated report on the same day, 23 January 2025. |
| CVE-2024-48883 | Medium | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, and Modem 5300. The UE incorrectly handles a malformed uplink scheduling message, resulting in an information leak of the UE. |
| CVE-2024-44298 | Medium | 2024-12-20 | Not applicable | No public exploit | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access information about a user's contacts. |
| CVE-2024-44292 | Medium | 2024-12-20 | Not applicable | No public exploit | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
| CVE-2024-49201 | Medium | 2024-12-18 | Not applicable | No public exploit | Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level. |
| CVE-2024-54504 | Medium | 2024-12-12 | Not applicable | No public exploit | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. |
| CVE-2024-54485 | Medium | 2024-12-12 | Not applicable | No public exploit | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2. An attacker with physical access to an iOS device may be able to view notification content from the lock screen. |
| CVE-2024-54477 | Medium | 2024-12-12 | Not applicable | No public exploit | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data. |
| CVE-2024-44200 | Medium | 2024-12-12 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to read sensitive location information. |
| CVE-2024-12082 | Medium | 2024-12-03 | Not applicable | No public exploit | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
| CVE-2024-8899 | Medium | 2024-11-26 | Not applicable | No public exploit | The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. |
| CVE-2024-3334 | Medium | 2024-11-15 | Not applicable | No public exploit | A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data. |
| CVE-2022-20939 | Medium | 2024-11-15 | Not applicable | No public exploit | A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this vulnerability by accessing certain logs on an affected system. A successful exploit could allow the attacker to use the obtained information to elevate privileges to System Admin.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. |
| CVE-2019-20469 | Medium | 2024-11-07 | Not applicable | No public exploit | An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatch. Audio files are stored in .amr format, in the audior directory. An attacker who has physical access can retrieve all audio files by connecting via a USB cable. |
| CVE-2024-34677 | Medium | 2024-11-06 | Not applicable | No public exploit | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate. |
| CVE-2024-51399 | Medium | 2024-11-01 | Not applicable | No public exploit | Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive information such as user credentials, system configuration, and database connection strings, which can lead to data breaches and identity theft. |
| CVE-2024-44275 | Medium | 2024-10-28 | Not applicable | No public exploit | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system. |
| CVE-2024-44263 | Medium | 2024-10-28 | Not applicable | No public exploit | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data. |
| CVE-2024-44257 | Medium | 2024-10-28 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access sensitive user data. |
| CVE-2024-44216 | Medium | 2024-10-28 | Not applicable | No public exploit | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access user-sensitive data. |
| CVE-2024-44174 | Medium | 2024-10-28 | Not applicable | No public exploit | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view restricted content from the lock screen. |
| CVE-2022-30361 | Medium | 2024-10-25 | Not applicable | Proof of concept only | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences. |
| CVE-2022-30359 | Medium | 2024-10-25 | Not applicable | Proof of concept only | OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences. |
| CVE-2024-30122 | Medium | 2024-10-23 | Not applicable | No public exploit | HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers. |
| CVE-2024-10041 | Medium | 2024-10-23 | Not applicable | No public exploit | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. |
| CVE-2024-20462 | Medium | 2024-10-16 | Not applicable | No public exploit | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML content from an affected device. A successful exploit could allow the attacker to view passwords that belong to other users. |
| CVE-2024-21258 | Medium | 2024-10-15 | No exploit published | No public exploit | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Installed Base accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). |
| CVE-2024-46635 | Medium | 2024-09-30 | Not applicable | No public exploit | An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted payload to the UserNameOrPhoneNumber parameter. |
| CVE-2024-47122 | Medium | 2024-09-26 | Not applicable | No public exploit | In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device (EUD). This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys stored on the EUD. This requires access to and control of the EUD, so it is recommended to use strong access control measures and layered encryption on the EUD for more secure operation. |
| CVE-2024-45374 | Medium | 2024-09-26 | Not applicable | No public exploit | The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via encrypted broadcast with that particular key. This only applies when the key is broadcasted over RF. This is an optional feature, so it is advised to use local QR encryption key sharing for additional security on this and previous versions. |
| CVE-2024-43694 | Medium | 2024-09-26 | Not applicable | No public exploit | In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device. |
| CVE-2024-39612 | Medium | 2024-09-02 | Not applicable | No public exploit | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
| CVE-2024-38382 | Medium | 2024-09-02 | Not applicable | No public exploit | in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
| CVE-2024-5288 | Medium | 2024-08-27 | Not applicable | No public exploit | An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault occurs. The success rate in a certain amount of connection requests can be processed via an advanced technique for ECDSA key recovery. |
| CVE-2024-42677 | Medium | 2024-08-15 | Not applicable | No public exploit | An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehandle. Aspx component |