1735 matches found
Rubyinstaller2 安全漏洞
RubyInstaller2 is an open source MSYS2-based RubyInstaller for Windows from the One-Click Project.An installer is provided for Ruby-2.4 and later on Windows. A security vulnerability exists in Rubyinstaller2 v3.1.2 and earlier versions, which stems from incorrect access control in the installatio...
CVE-2022-32745
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault...
AZL-37015 CVE-2022-32746 affecting package samba for versions less than 4.18.3-1
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl...
Improper access control
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists...
CVE-2022-37062
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and...
CVE-2022-37062
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and...
CVE-2022-37062
The CVE-2022-37062 issue affects Teledyne FLIR AX8 thermal sensor cameras version up to and including 1.46.16, due to an insecure design from improper directory access restriction that allows an unauthenticated remote attacker to request a URI containing the path to the SQLite users database and ...
PT-2022-23778 · Flir · Flir Ax8
Name of the Vulnerable Software and Affected Versions: FLIR AX8 thermal sensor cameras version up to and including 1.46.16 Description: The issue is due to an improper directory access restriction, allowing an unauthenticated, remote attacker to exploit it by sending a URI that contains the path ...
YugabyteDB 授权问题漏洞
YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte USA. A security vulnerability exists in YugabyteDB version 2.6.1 that stems from a vulnerability that allows authentication to be bypassed using a null password when anonymous or...
LDAP Injection Authentication Bypass
Lightweight Directory Access Protocol LDAP is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On SSO service that will allow clients to authenticate with a web site without any interaction assuming...
GHSA-8CW9-5HMV-77W6 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Impact Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Patches - v20.12.7 LTS - v21.12.2 LTS - v22.6.1 References https://github.com/sanic-org/sanic/issues/2478 https://github.com/sanic-org/sanic/pull/2495 For more...
PT-2022-23026
Name of the Vulnerable Software and Affected Versions Sanic versions prior to 20.12.7 Sanic versions prior to 21.12.2 Sanic versions prior to 22.6.1 Description The issue allows access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not...
UBUNTU-CVE-2022-32745
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault...
HelpSystems GoAnywhere MFT 路径遍历漏洞
HelpSystems GoAnywhere MFT is a hosted file transfer software from HelpSystems USA. A path traversal vulnerability exists in HelpSystems GoAnywhere MFT prior to version 6.8.3, which originates from allowing an external user who self-registers with a specific username or profile information to gai...
389-ds-base: sending crafted message could result in DoS
A vulnerability was found in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection. No bind or other authentication is required. This...
IBM Sterling Partner Engagement Manager 注入漏洞
IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. An LDAP injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the fact that some parameters in the code are not properly filtered and can be exploited by an authenticated...
CVE-2022-22360
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...
CVE-2022-31159 Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the...
flask-file-server path traversal vulnerability
flask-file-server is a file server with a front-end for browsing, uploading, and streaming files from Wildog Personal Developer. flask-file-server 2020-02-20 and earlier versions are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly...