CVE-2023-6592

CVE-2023-6592 refers to the FastDup WordPress plugin (pre-2.2) which does not prevent directory listing in sensitive export directories, potentially exposing backups and related data. The vulnerability allows unauthenticated access to files under plugin paths (e.g., logs and backups), as document...

PT-2024-15017

Name of the Vulnerable Software and Affected Versions FastDup WordPress plugin versions prior to 2.2 Description The issue concerns the FastDup WordPress plugin, which does not prevent directory listing in sensitive directories containing export files. This could potentially expose sensitive...

The vulnerability of the APK-reverse engineering tool Apktool in Android systems arises from incorrect path name restrictions for restricted directories. This allows attackers to write or overwrite arbitrary data.

The vulnerability of the APK-reverse engineering tool Apktool relates to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a perpetrator to write or overwrite arbitrary data...

The vulnerability of the Reactor Netty HTTP server arises from incorrect path name restrictions for restricted access directories, allowing attackers to disclose protected information.

The vulnerability of the Reactor Netty HTTP server is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by this system...

CVE-2023-6505

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

Design/Logic Flaw

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

Security researchers have detailed a new variant of a dynamic link library DLL search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages...

GHSA-7C44-7J7V-W554 Buildkite Elastic CI for AWS symbolic link following vulnerability

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CentOS 7 : insights-client (RHSA-2023:6795)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory. - A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

The vulnerability of the Go programming language’s filepath package, which allows attackers to disclose protected information

The vulnerability of the Go programming language’s filepath package is related to incorrect restrictions on the path name for restricted access directories. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

PT-2023-31439 · Unknown · Student Result Management System

Name of the Vulnerable Software and Affected Versions: Best Student Result Management System version 1.0 Description: A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization. Recommendations: For Best Student Result...

Local Privilege Escalation

pyinstaller is vulnerable to Local Privilege Escalation. The vulnerability exists due to insecure directories used in the library, allowing an attacker to delete files on the system if the applications contains either matplotlib or win32com, and the temporary directory is not locked to a specific...

The vulnerability in the /lib/tinymce/examples/index.html component of SysAid’s software for support and control of hardware and software systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the /lib/tinymce/examples/index.html component of SysAid’s automation software relates to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

The vulnerability of the APIX application programming interface for the AXIS OS operating system allows a hacker to delete any files they desire.

The vulnerability of the APIX application programming interface for the AXIS OS operating system relates to incorrect restrictions on path names to restricted directories. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system allows a hacker to move any files they desire.

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system involves the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a hacker to move arbitrary files...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...