PT-2022-17648 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 16.00.0112 Description: An information disclosure issue exists in the OAS Engine SecureTransferFiles functionality. A specially-crafted series of network requests can lead to arbitrary file read. ...

GHSA-QXM5-VX5J-PP6W snapcraft Access Restriction Bypass

In some conditions, a snap package built by snapcraft includes the current directory in LDLIBRARYPATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to...

PT-2022-6888 · Libtiff +8 · Libtiff +8

Name of the Vulnerable Software and Affected Versions: libtiff version 4.4.0rc1 Description: The issue is related to an invalid pointer free operation in the TIFFClose function at tif close.c:131, called by tiffcrop.c:2522. This can cause a program crash and denial of service when processing...

PT-2022-3610

Name of the Vulnerable Software and Affected Versions dicer versions all Description The issue is related to the dicer package, where a malicious attacker can send a modified form to the server, causing the Node.js service to crash. By sending the payload repeatedly, an attacker can achieve a...

PT-2022-19757 · Unknown · Online Sports Complex Booking System

Name of the Vulnerable Software and Affected Versions: Online Sports Complex Booking System version 1.0 Description: The issue concerns SQL Injection via the "/scbs/classes/Users.php?f=save client" endpoint. This allows for potential manipulation of database queries, which could lead to...

GHSA-VPM6-H53M-X2XF Drupal improper access restrictions

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

Drupal improper access restrictions

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

Apache Ranger Access Restriction Bypass

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...

GHSA-22V7-W6C5-V4RR Apache Ranger Access Restriction Bypass

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...

TYPO3 Path Traversal vulnerability

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as...

GHSA-66J3-66CP-6C2M TYPO3 Path Traversal vulnerability

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as...

Zend Access Restriction Bypass

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind...

PT-2022-18045 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS Monterey versions prior to 12.4 Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue allows an attacker that has already achieved code execution in macOS Recovery to potentially escalate to...

[ASA-202205-1] python-httpx: access restriction bypass

Arch Linux Security Advisory ASA-202205-1 ========================================= Severity: Critical Date : 2022-05-16 CVE-ID : CVE-2021-41945 Package : python-httpx Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2718 Summary ======= The package...

PT-2022-13960 · WordPress · Amministrazione Aperta

Name of the Vulnerable Software and Affected Versions: Amministrazione Aperta WordPress plugin versions prior to 3.8 Description: The issue is related to a Local File Inclusion problem due to the lack of validation of the open parameter before using it in an include statement. Although initially...

Sensitive Data Exposure in baserCMS

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors...

GHSA-W935-P7MG-XC96 Sensitive Data Exposure in baserCMS

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors...

GHSA-3XPJ-JGV5-Q4VV Access restriction bypass in Apache Tomcat

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an...

Access restriction bypass in Apache Tomcat

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an...

GHSA-HFFM-FQV4-W27R Improper Authentication in Apache Tomcat

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weak...