Monthly
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. [CVSS 5.3 MEDIUM]
A vulnerability has been identified in QMS Automotive (All versions < V12.39). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. [CVSS 5.3 MEDIUM]
A vulnerability has been identified in QMS Automotive (All versions < V12.39). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.