UBUNTU-CVE-2024-28826

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

Redmine DMSF Plugin vulnerable to path traversal

Overview Redmine DMSF Plugin provided by Kontron contains a path traversal vulnerability CWE-22. Tsukuba Secure Network Research Co. Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When the affected...

PT-2024-22594

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.3.0p4 Checkmk versions prior to 2.2.0p27 Checkmk versions prior to 2.1.0p44 Checkmk version 2.0.0 Description The issue is related to improper restriction of local upload and download paths in the check sftp...

CVE-2024-5433 Path Traversal in Campbell Scientific CSI Web Server and RTMC

The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated...

PT-2024-26233 · F Logic · F-Logic Datacube3

Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: The issue is related to command injection due to improper string filtering at the command execution point in the ./admin/transceiver schedule.php file. An unauthenticated remote attacker can exploit...

PT-2024-40446 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue allows extraction of pre-configured database or default admin account passwords by viewing the source of the page and inspecting the value property of the password fields when...

OpenAPI Tools OpenAPI Generator 安全漏洞

OpenAPI Tools OpenAPI Generator is an OpenAPI generator. The product allows automatic generation of API client libraries SDK generation, server stubs, documentation, configuration, etc. given the OpenAPI specification v2, v3. A security vulnerability exists in OpenAPI Tools OpenAPI Generator prio...

The vulnerability of the Windows Search service in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Search service in Windows operating systems is related to the incorrect handling of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-4388 CAS <= 1.0.0 - Unauthenticated Arbitrary File Access

This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...

CVE-2024-4388 CAS <= 1.0.0 - Unauthenticated Arbitrary File Access

This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...

CVE-2024-35162

CVE-2024-35162 : Path traversal in Download Plugins and Themes from Dashboard allows a remote authenticated user with the switch_themes privilege to obtain arbitrary server files. Affected plugin: Download Plugins and Themes from Dashboard (WordPress). Vulnerability arises in versions prior to 1....

ZkTeco OEM 路径遍历漏洞

ZkTeco OEM is an intelligent system from the Chinese company ZkTeco. ZkTeco OEM suffers from a path traversal vulnerability that originates from allowing an attacker to access any file on the system. The following products and versions are affected: ZkTeco ProFace X, Smartec ST-FR043, Smartec...

PT-2024-4481 · Smartec +1 · Smartec St-Fr041Me +2

Name of the Vulnerable Software and Affected Versions: ZkTeco ProFace X versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR043 versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR041ME versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of Windows operating system kernels is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to increase their privileges...

Qualys Enterprise TruRisk™ Platform Extends FIM with Real-Time Monitoring of Unauthorized Access to Sensitive Data and Configuration Change Detection on Network Devices

Introducing FIM 4.0 with File Access Monitoring FAM and Agentless FIM to ensure compliance with the new PCI 4.0 File Integrity Monitoring FIM solutions are essential for virtually any organization to help identify suspicious activities across critical system files and registries, diagnose changes...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to improper validation of artifact URLs, particularly in handling the fragment part of the URL. Attackers can exploit this by inserting a 'character, allowing the artifact to bypass validation, resulting an arbitrary file access on...

PT-2024-22177 · Woocommerce · Premmerce Permalink Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Premmerce Permalink Manager for WooCommerce versions prior to 2.3.11 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allow...

Online Birth Certificate Management System 安全漏洞

Online Birth Certificate Management System is an online birth certificate management system by Carlo Montero Individual Developer. A security vulnerability exists in Online Birth Certificate Management System version 1.0, where unknown code originating from file/admin can cause a file or director...

CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2024-20389

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...