The vulnerability of the Reactor Netty HTTP server arises from incorrect path name restrictions for restricted access directories, allowing attackers to disclose protected information.

The vulnerability of the Reactor Netty HTTP server is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by this system...

CVE-2023-6505

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

Design/Logic Flaw

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

CVE-2023-6505: Undefined Security Weakness

The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

Security researchers have detailed a new variant of a dynamic link library DLL search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages...

GHSA-7C44-7J7V-W554 Buildkite Elastic CI for AWS symbolic link following vulnerability

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

The vulnerability of the Go programming language’s filepath package, which allows attackers to disclose protected information

The vulnerability of the Go programming language’s filepath package is related to incorrect restrictions on the path name for restricted access directories. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

CentOS 7 : insights-client (RHSA-2023:6795)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory. - A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and...

PT-2023-31439 · Unknown · Student Result Management System

Name of the Vulnerable Software and Affected Versions: Best Student Result Management System version 1.0 Description: A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization. Recommendations: For Best Student Result...

Local Privilege Escalation

pyinstaller is vulnerable to Local Privilege Escalation. The vulnerability exists due to insecure directories used in the library, allowing an attacker to delete files on the system if the applications contains either matplotlib or win32com, and the temporary directory is not locked to a specific...

CVE-2023-5907: Files or Directories Accessible to External Parties

The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowe...

The vulnerability in the /lib/tinymce/examples/index.html component of SysAid’s software for support and control of hardware and software systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the /lib/tinymce/examples/index.html component of SysAid’s automation software relates to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

The vulnerability of the APIX application programming interface for the AXIS OS operating system allows a hacker to delete any files they desire.

The vulnerability of the APIX application programming interface for the AXIS OS operating system relates to incorrect restrictions on path names to restricted directories. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system allows a hacker to move any files they desire.

The vulnerability of the file renaming function of the ASUSTOR Data Master operating system involves the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a hacker to move arbitrary files...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

EZVIZ Studio Security Vulnerability

EZVIZ Studio is an application from the Chinese company Fluorite EZVIZ. It is used to manage your camera on a personal computer. A security vulnerability exists in EZVIZ Studio version v2.2.0, which originates from a DLL hijacking that can be performed by planting a malicious TcApi.dll in certain...