PT-2022-12221

Name of the Vulnerable Software and Affected Versions F-Secure Support Tool affected versions not specified Description An arbitrary code execution issue was found in the F-Secure Support Tool. A standard user can create a special configuration file that, when executed by an administrator, can ru...

CVE-2021-44750: Undefined Security Weakness

An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands...

CVE-2021-3981

CVE-2021-3981 — GRUB2 grub.cfg permission issue . Affected: grub2 (2.06 and earlier). Root cause: configuration file grub.cfg created with insecure permissions, enabling non-privileged users to read contents (confidentiality impact). Impact: low severity per description; reads of encrypted passwo...

CVE-2021-3981

A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in...

CVE-2021-35036: Cleartext Storage of Sensitive Information

A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50ABTL.0b2k could allow an authenticated attacker to obtain sensitive information from the configuration file...

CVE-2022-24340

In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible...

Code injection

In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible...

CVE-2022-24340

In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible...

CVE-2022-24340

CVE-2022-24340 (TeamCity) represents an XML External Entity (XXE) vulnerability in JetBrains TeamCity prior to 2021.2.1, triggered during parsing of configuration files. The issue could impact confidentiality, integrity, and availability to a high degree, as indicated by the CVSS data (high/criti...

CVE-2022-24340: Improper Restriction of XML External Entity Reference

In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible...

GHSA-8WR4-2WM6-W3PR B2 Command Line Tool TOCTOU application key disclosure

Impact Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. The command line tool saves API keys and bucket...

USN-5293-2: c3p0 vulnerability

USN-5293-1 fixed a vulnerability in c3p0. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could...

USN-5293-2 c3p0 vulnerability

USN-5293-1 fixed a vulnerability in c3p0. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could...

USN-5293-1: c3p0 vulnerability

Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application's XML configuration file could cause a denial of service...

Dbltek GoIP GHSFVT-1.1-67-5 Local File Inclusion

Exploit Title: Dbltek GoIP - Local File Inclusion Date: 20.02.2022 Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a...

Dbltek GoIP - Local File Inclusion Vulnerability

Exploit Title: Dbltek GoIP - Local File Inclusion Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a VoIP-GSM gateway...

Dbltek GoIP - Local File Inclusion

Exploit Title: Dbltek GoIP - Local File Inclusion Date: 20.02.2022 Exploit Author: Valtteri Lehtinen & Lassi Korhonen Vendor Homepage: http://en.dbltek.com/index.html Software Link: - Version: GHSFVT-1.1-67-5 firmware version Tested on: Target is an IoT device Exploit summary Dbltek GoIP-1 is a...

SUSE-SU-2022:0507-1 Security update for cobbler

This update for cobbler fixes the following issues: - CVE-2021-45083: Fixed unsafe permissions on sensitive files bsc1193671. The following non-security bugs were fixed: - Move configuration files ownership to apache bsc1195906...

(Pwn2Own) Lexmark MC3224i Web Configuration File Code Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP server. The issue results from the lack of proper validation...

HYBBS 默认配置问题漏洞

HYBBS is a lightweight community forum program. A default configuration issue vulnerability exists in HYBBS, which stems from the product writing plugin-related configuration information to conf.php. An attacker can use this vulnerability to execute code on the Admin.php page. The following...