14585 matches found
PT-2024-7548 · Microsoft · Azure Monitor Agent
Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Azure Monitor Agent, which is used for data collection from virtual machines VM and physical servers. The...
PT-2024-2889 · Microsoft · Azure Monitor Agent
Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent affected versions not specified Description: The issue is related to an incorrect reference count before accessing a file, which can be exploited to elevate privileges. Recommendations: At the moment, there is no informati...
PT-2024-24248 · Apache · Apache Zeppelin
Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 through 0.10.x Description: The issue is related to improper input validation, allowing attackers to access files in the filesystem by adding relative path indicators e.g ... This enables them to see the content...
Arbitrary File Read
github.com/canonical/pebble is vulnerable to a Arbitrary File Read. The vulnerability is due to the read-file API and the associated pebble pull command, allowing unprivileged local users to access files with root-equivalent permissions when Pebble is operating as root...
The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform allows a malicious actor to read and write arbitrary files into the system.
The vulnerability of the Splunk Enterprise platform for operational analysis is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files into the system using a specially created HTTP...
Huawei HarmonyOS 安全漏洞
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A directory traversal vulnerability exists in Huawei...
Pebble service manager's file pull API allows access by any user
Impact Note: "Pebble" here refers to Canonical's service manager, not the Let's Encrypt ACME test server. The API behind pebble pull, used to read files from the workload container by Juju charms, allows access from any user, instead of just admin. In Juju Kubernetes sidecar charms, Pebble and th...
CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read
Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...
PT-2024-21092 · Esri · Esri Portal For Arcgis
Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions prior to 11.3 Description: The issue concerns a path traversal that could allow a remote, authenticated attacker to access files or execute code outside the intended directory. Recommendations: For Esri Portal...
CVE-2024-20348
A vulnerability in the Out-of-Band OOB Plug and Play PnP feature of Cisco Nexus Dashboard Fabric Controller NDFC could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this...
CVE-2024-26703 tracing/timerlat: Move hrtimer_init to timerlat_fd open()
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Move hrtimerinit to timerlatfd open Currently, the timerlat's hrtimer is initialized at the first read of timerlatfd, and destroyed at close. It works, but it causes an error if the user program open and close t...
Voilà Local file inclusion
Impact Any deployment of voilà dashboard allow local file inclusion, that is to say any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how...
CVE-2023-35812
An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verificati...
GitPython: Blind local file inclusion
A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...
Stilog Visual Planning 安全漏洞
Stilog Visual Planning is software from Stilog that allows you to efficiently manage resource allocation and share schedules with employees. A security vulnerability exists in Stilog Visual Planning 8. An attacker could exploit the vulnerability to access local server files and leak data to an...
Podman affected by CVE-2024-1753 container escape at build time
Impact What kind of vulnerability is it? Who is impacted? Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed. Patches From @nalind . This is a patc...
GHSA-874V-PJ72-92F3 Podman affected by CVE-2024-1753 container escape at build time
Impact What kind of vulnerability is it? Who is impacted? Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed. Patches From @nalind . This is a patc...
PT-2024-12054 · Unknown · Ladle Dev Server
Name of the Vulnerable Software and Affected Versions: Ladle Dev Server versions 2.5.1 and earlier Description: A Directory Traversal issue allows an attacker on the same network to read files accessible to the user via GET requests. This can be exploited by sending requests to specific API...
PT-2024-23239 · Apache · Apache Dolphinscheduler
Name of the Vulnerable Software and Affected Versions: Apache DolphinScheduler versions 3.1.0 through 3.2.1 Description: A file read and write vulnerability exists in Apache DolphinScheduler, allowing authenticated users to illegally access additional resource files. Recommendations: For Apache...
