@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +51 more potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (>=2.0.3, <=2.2.7)

@vendure/asset-server-plugin NPM version =2.0.3, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2024-48914 Source advisory: OSV:GHSA-R9MQ-3C9R-FMJQ...

@semic/testing (2.2.11) potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (3.0.0)

@vendure/asset-server-plugin NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vendure/asset-server-plugin and may be impacted: - @semic/testing 2.2.11 Source cves: CVE-2024-48914 Source advisory: OSV:GHSA-R9MQ-3C9R-FMJQ...

@semic/testing (2.2.11) potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (3.0.0)

@vendure/asset-server-plugin NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vendure/asset-server-plugin and may be impacted: - @semic/testing 2.2.11 Source cves: CVE-2024-48914 Source advisory: GHSA-R9MQ-3C9R-FMJQ...

GHSA-R9MQ-3C9R-FMJQ Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Description Path traversal This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +51 more potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (>=2.0.3, <=2.2.7)

@vendure/asset-server-plugin NPM version =2.0.3, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2024-48914 Source advisory: GHSA-R9MQ-3C9R-FMJQ...

CVE-2024-48914

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

@artcoded/gcp-asset-server-plugin (>=1.0.1, <=1.0.4), @grupo-loja/vendure-banner-plugin (1.0.0) +54 more potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (>=0.12.5, <=2.2.7)

@vendure/asset-server-plugin NPM version =0.12.5, =1.0.1, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2024-48914 Source advisory: MEND:CVE-2024-48914...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

@semic/testing (2.2.11) potentially affected by CVE-2024-48914 via @vendure/asset-server-plugin (3.0.0)

@vendure/asset-server-plugin NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vendure/asset-server-plugin and may be impacted: - @semic/testing 2.2.11 Source cves: CVE-2024-48914 Source advisory: MEND:CVE-2024-48914...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914

Summary (CVE-2024-48914): Vendure’s asset server plugin allows an attacker to traverse the server filesystem and read arbitrary files, including configs and environment data, due to using the decoded request path directly in path.join (no normalization). A second vector in the same code path can ...

CVE-2024-48914: Improper Limitation of a Pathname to a Restricted Directory

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

5 Steps to Boost Detection and Response in a Multi-Layered Cloud

The link between detection and response DR practices and cloud security has historically been weak. As global organizations increasingly adopt cloud environments, security strategies have largely focused on "shift-left" practices—securing code, ensuring proper cloud posture, and fixing...

CVE-2024-9539

An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to uplo...

Lenovo Baiying security vulnerability

Lenovo Baiying 联想百应 is an asset management software from the Chinese company Lenovo. A security vulnerability exists in Lenovo Baiying. A local attacker could exploit the vulnerability to elevate privileges and execute code...

Rockwell Automation Verve Asset Manager

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : Verve Asset Manager Vulnerability : Placement of User into Incorrect Group 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

PT-2024-10159 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: GLPI is a free asset and IT management software package. The issue is related to incorrect access control, allowing an authenticated user to use an application endpoint to delete any user accoun...

CVE-2024-9412 Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager

An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an...

CVE-2024-9412 Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager

An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an...