CVE Vulnerability Catalog

MediaCMS 8.2.0 has an information disclosure vulnerability allowing authenticated users to access private media metadata of other users by adding media tokens to their own playlist without access control. Attackers can use a PUT request to the playlist API with a known token and then read private fields like title, description, view count, file size, and author username.

Tanium Server has a vulnerability involving User Interface Misrepresentation of Critical Information.

Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created with mode 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.

Vulnerability in Data::Intern::Shared for Perl before version 0.02 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::RingBuffer::Shared for Perl before version 0.04 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::HashMap::Shared for Perl before version 0.14 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::RadixTree::Shared for Perl before version 0.02 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::SortedSet::Shared for Perl before version 0.03 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::ReqRep::Shared for Perl before version 0.05 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::PubSub::Shared for Perl before version 0.07 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::NDArray::Shared for Perl before version 0.02. The mmap backing file is created with mode 0666, resulting in 0644 (world-readable) under default umask 022. Missing O_EXCL and O_NOFOLLOW flags allow a local attacker to follow a symlink or replace the file before creation.

Vulnerability in Data::Graph::Shared for Perl before version 0.04 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::Deque::Shared for Perl before version 0.06 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in SoupAuthManager that caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leading to credential leakage.

Concurrent Login vulnerability in HCL MyCloud increases the risk of unauthorized access, session hijacking, and account misuse.

HCL MyCloud is affected by the SSL/TLS LUCKY13 vulnerability. An attacker can decrypt sensitive information via a TLS/SSL padding oracle attack.

HCL MyCloud has a missing Cookie Attribute Path vulnerability. This increases the risk of unauthorized access to session data or authentication tokens.

HCL MyCloud is affected by using components with known vulnerabilities (IIS Server). This may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

Vulnerability in HCL MyCloud exposes the license key in HTTP responses. Attackers can misuse this information to compromise application security.

HCL MyCloud exposes the server version, which may help attackers identify and exploit known vulnerabilities for the disclosed software versions.