CVE-2023-52596

An out of bounds access flaw was found in empty sysctl registers in the Linux kernel. This may lead to a crash...

CVE-2024-28151

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to...

BIT-DJANGO-2020-24583

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. FILEUPLOADDIRECTORYPERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level...

BIT-JENKINS-2023-27902

Jenkins LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents...

UBUNTU-CVE-2023-52596

In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix out of bounds access for empty sysctl registers When registering tables to the sysctl subsystem there is a check to see if header is a permanently empty directory used for mounts. This check evaluates the first elemen...

CVE-2023-45594

CVE-2023-45594 affects AiLux imx6 bundle earlier than imx6_1.0.7-2. The root cause is a CWE-552 vulnerability in the embedded Chromium browser that could allow a physical attacker to arbitrarily download or upload files to the device’s filesystem, with impacts on confidentiality, integrity, and a...

CVE-2023-45594: Files or Directories Accessible to External Parties

A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download/upload files to/from the file system, with unspecified impacts to the confidentiality, integrity, and availability of the device. This...

The vulnerability of the chown package on the Node.js software platform allows a malicious actor to gain unauthorized access to arbitrary directories.

The vulnerability of the chown package on the Node.js software platform is related to synchronization errors when using a shared resource „Race Condition“. Exploiting this vulnerability can allow an attacker to gain unauthorized access to arbitrary directories...

CLSA-2024-1709203226 kernel: Fix of 7 CVEs

KVM: nSVM: avoid picking up unsupported bits from L2 in intctl CVE-2021-3653 CVE-2021-3653 - xen/netfront: fix leaking data in shared pages CVE-2022-33740 - xfs: fix up non-directory creation in SGID directories CVE-2021-4037 - netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 -...

CentOS 9 : openjpeg2-2.4.0-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openjpeg2-2.4.0-7.el9 build changelog. - A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it...

Information disclosure

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files...

CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files...

CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files...

CVE-2023-7165

The JetBackup WordPress plugin (versions prior to 2.0.9.9 ) is vulnerable to sensitive information exposure due to a lack of index files in certain configurations. This allows malicious actors with web server access to perform public directory listing and leak sensitive backup files . To remediat...

WordPress plugin JetBackup security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in the...

CVE-2024-1155

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access...

Privilege escalation

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access...

The vulnerability of the monitoring tool for VMware Aria Operations lies in the use of files and directories accessible from external parties, allowing a perpetrator to gain unauthorized access to protected information.

The vulnerability of the monitoring tool for VMware Aria Operations relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the software for processing servlets in web applications on the Java Apache Sling Servlets Resolver platform arises from incorrect pathname restrictions for restricted directories. This allows attackers to execute arbitrary code.

The vulnerability of the software for processing servlets in web applications on the Java Apache Sling Servlets Resolver platform is related to incorrect pathname restrictions for restricted directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotel...

CVE-2024-0032

In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation...