Jenkins Assembla Auth Plugin stores credentials in plain text

Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Bolt Cross Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file...

Input validation

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

CVE-2022-29898 Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

PT-2022-2510

Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT RAD-ISM-900-EN- devices all versions of the firmware Description The issue arises from an improper validation of an integrity check value in the configuration file uploader of the WebUI, allowing an admin user to execute...

PT-2022-12958

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 8.1 through 8.1.22 Palo Alto Networks PAN-OS versions 9.0 through 9.0.15 Palo Alto Networks PAN-OS versions 9.1 through 9.1.12 Palo Alto Networks PAN-OS versions 10.0 through 10.0.9 Palo Alto Networks PAN-OS...

CVE-2022-0024: Improper Neutralization of Special Elements

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committ...

CVE-2022-29898: Improper Validation of Integrity Check Value

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

Open-Xchange: Privilege escalation possible in dovecot when similar passdbs are used

Summary --------- Privilege escalation is possible as a result of incorrect security code logic for dovecot passdb definitions. Description ------------ When two passdb configuration entries exist in the dovecot configuration which have the same driver and args settings, the incorrect...

GHSA-G7P7-X6W7-W6QG Arbitrary file deletion in gitea

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service DoS via deleting the configuration file...

Gitea < 1.16.4 DoS Vulnerability

Gitea is prone to a denial of service DoS vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

CVE-2022-27313

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service DoS via deleting the configuration file...

CVE-2022-27313

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service DoS via deleting the configuration file...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea version 1.16.3 that originates from a denial of service DoS via deletion of a configuration file. An attacker can exploit the vulnerability to delete arbitrary files...

CVE-2022-27313: Undefined Security Weakness

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service DoS via deleting the configuration file...

Telesquare TLR-2005Ksh file download vulnerability

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from Telesquare Korea. Telesquare TLR-2005Ksh version 1.0.0 is vulnerable to a file download vulnerability that stems from a lack of authentication strength. A remote attacker can exploit this vulnerability to be able to download the complete...

CVE-2022-28719

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code...

Authentication flaw

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code...

CVE-2022-28719

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code...

PT-2022-19195

Name of the Vulnerable Software and Affected Versions AssetView versions prior to 13.2.0 Description The issue is related to missing authentication for a critical function in AssetView, allowing a remote unauthenticated attacker with some knowledge of the system configuration to upload a crafted...