Ivanti Addressed A New Zero-Day Flaw in Ivanti Sentry

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-38035 in Ivanti Sentry versions 9.18 and earlier allows unauthenticated access to sensitive APIs via port 8443, posing a risk of configuration manipulation and...

CVE-2023-32226

Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method...

U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████

An access control bypass vulnerability was discovered in Adobe ColdFusion, allowing attackers to bypass the restriction on external access to the ColdFusion Administrator...

Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD

Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and write access...

PYSEC-2023-9

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

CVE-2023-1246

Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations.This issue affects Starcities: through 1.3...

PT-2023-7987 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the use of files and directories accessible to external parties, potentially allowing a remote attacker to gain read-only access to the file system on behalf of the...

SUSE CVE-2007-0248

The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service crash by causing an externalacl queue overload, which triggers an infinite loop...

The vulnerability of Zyxel AX7501-B0 router microprogramming software, related to the use of files and directories accessible to external parties, allows a hacker to gain access to the root file system.

The vulnerability of Zyxel AX7501-B0 router microprogramming software is related to the use of files and directories accessible to external parties. Exploiting this vulnerability can allow a attacker to gain access to the root file system...

Malicious code in speedtestgod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42642a07abf71a7986c009eabcb9646de62538ed2712bed7492f7e6ee96e65d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-37424

Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery...

CVE-2022-37424

CVE-2022-37424 concerns OpenNebula on Linux. The vulnerability arises from the FILES directive, which may allow arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from a template, potentially causing Information Disclosure. Affected details (s...

CVE-2022-23768

This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device...

PT-2022-5098 · Unknown · Nis-Hap11Ac

Name of the Vulnerable Software and Affected Versions: NIS-HAP11AC affected versions not specified Description: The issue is related to insufficient access control in the NIS-HAP11AC wireless access point firmware. It allows a remote attacker to execute arbitrary code via the external telnet port...

Malicious code in crsosspsawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5828716e5e9932309d545a02aede3d1cc990b8b019ef2f1e2811ee3169b382e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exposure of critical functions

Lines of code Vulnerability details Impact AdminRole mixin exposes critical functions without any restrictions like grantAdmin revokeAdmin Proof of Concept Criticial functions like grantAdmin can be externally accessed changing the critical roles like admin. // for eg: function grantAdminaddress...

PT-2022-23989 · Unknown · Opennebula

Name of the Vulnerable Software and Affected Versions: OpenNebula affected versions not specified Description: The issue allows files or directories to be accessible to external parties, enabling file discovery. This affects OpenNebula on Linux. Recommendations: At the moment, there is no...

Malicious code in identity-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde25fc414a1b79770a05f254f717a98c8b648dd939d6b12dc573aef2e48c29f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dodo-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc32b64a228596246662622015254a4093d3c5ca89a8e7d4b74cccacfdd273 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbpay/merchant-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff532b8bb4d8394da283651d098a5f4b99d05a8cb40e0417ea040d71fc80b35b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...