CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-20515 – Cisco Identity Services Engine Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20515
02 Oct 2024 — A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disc-ZYF2nEEX •
CVSS: 8.6EPSS: 0%CPEs: 14EXPL: 0CVE-2024-20491 – Cisco Nexus Dashboard Insights Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20491
02 Oct 2024 — A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. ... Note: Best practice is to store debug logs and tech support files safely and to share them only with trusted parties because they may contain sensitive information. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc •
CVSS: 8.6EPSS: 0%CPEs: 31EXPL: 0CVE-2024-20490 – Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20490
02 Oct 2024 — A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. ... Note: Best practice is to store debug logs and tech support files safely and to share them only with trusted parties because they may contain sensitive information. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc •
CVSS: 8.6EPSS: 0%CPEs: 38EXPL: 0CVE-2024-20448 – Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-20448
02 Oct 2024 — A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper storage of sensitive information within config only and full backup files. ... A successful exploit could allow the attacker to access sensitive information, including NDFC-connected device credentials, the NDFC site manager private k... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cidv-XvyX2wLj •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45408 – eLabFTW contains a direct and indirect information disclosure
https://notcve.org/view.php?id=CVE-2024-45408
01 Oct 2024 — An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. • https://github.com/elabftw/elabftw/security/advisories/GHSA-2c83-6j74-w8r5 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45792 – MantisBT vulnerable to information disclosure with user profiles
https://notcve.org/view.php?id=CVE-2024-45792
30 Sep 2024 — Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. • https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h5q3-fjp4-2x7r • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: -EXPL: 0CVE-2024-35495
https://notcve.org/view.php?id=CVE-2024-35495
30 Sep 2024 — An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers to observe device state via observing network traffic. • https://github.com/Chapoly1305/tp-link-cve/blob/main/CVE-2024-35495.md • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: -EXPL: 1CVE-2024-46635
https://notcve.org/view.php?id=CVE-2024-46635
30 Sep 2024 — An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted payload to the UserNameOrPhoneNumber parameter. • https://hithub.notion.site/Sensitive-Information-Disclosure-in-GongZhiDao-System-aaad25d2430f4a638d462194cfa87c8b • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47344 – WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability
https://notcve.org/view.php?id=CVE-2024-47344
27 Sep 2024 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StylemixThemes uListing.This issue affects uListing: from n/a through 2.1.5. The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.5 via the /pricing-plan/payment endpoint. • https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-1-5-sensitive-data-exposure-vulnerability? • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8974 – Incorrect Provision of Specified Functionality in GitLab
https://notcve.org/view.php?id=CVE-2024-8974
26 Sep 2024 — Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project." • https://gitlab.com/gitlab-org/gitlab/-/issues/482843 • CWE-684: Incorrect Provision of Specified Functionality •