Shanxi Diankeyun Technology NODERP Security Vulnerability

Shanxi Diankeyun Technology NODERP is an ERP system from Shanxi Diankeyun Technology. A security vulnerability exists in Shanxi Diankeyun Technology NODERP version 6.0.2, which stems from an issue with the file /runtime/log, which could result in an accessible file or directory...

PT-2024-15229 · WordPress · Wp Staging

Name of the Vulnerable Software and Affected Versions: WP STAGING WordPress Backup plugin versions prior to 3.2.0 Description: The issue allows access to cache files during the cloning process. This provides unauthorized access to sensitive information. Recommendations: For versions prior to 3.2....

PT-2024-15965 · Sichuan Yougou Technology · Kuerp

Name of the Vulnerable Software and Affected Versions: Sichuan Yougou Technology KuERP versions up to 1.0.4 Description: A problematic issue has been found, affecting the function del sn db of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path...

UBUNTU-CVE-2023-38319

An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...

UBUNTU-CVE-2023-38318

An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...

PT-2024-15122 · Biges Safe Life Technologies Electronics Inc · Vguard

Name of the Vulnerable Software and Affected Versions: Biges Safe Life Technologies Electronics Inc. VGuard versions prior to V500.0003.R008.4011.C0012.B351.C Description: The issue is related to a Path Traversal vulnerability, specifically an Absolute Path Traversal, which can be exploited using...

PT-2024-15938 · Unknown · Codeastro Stock Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Stock Management System version 1.0 Description: A vulnerability was found in the CodeAstro Stock Management System, affecting some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of...

openNDS Security Vulnerabilities

openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in openNDS prior to version 10.1.3 that stems from an inability to clean up a stateful path script entry in a configuration file, which could allow an attacker with direct or indirect...

Open redirect

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

CVE-2024-21765

Electronic Delivery Check System Doboku Ver.18.1.0 and earlier, Electronic Delivery Check System Dentsu Ver.12.1.0 and earlier, Electronic Delivery Check System Kikai Ver.10.1.0 and earlier, and Electronic delivery item Inspection Support SystemVer.4.0.31 and earlier improperly restrict XML...

PT-2024-15867 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.4-25556-8 Synology DiskStation Manager DSM versions prior to 7.0.1-42218-7 Synology DiskStation Manager DSM versions prior to 7.1.1-42962-7 Synology DiskStation Manager DSM versions prior...

Jenkins cli Ampersand Replacement Arbitrary File Read

This module utilizes the Jenkins cli protocol to run the help command. The cli is accessible with read-only permissions by default, which are all thats required. Jenkins cli utilizes args4j's parseArgument, which calls expandAtFiles to replace any @ with the contents of a file. We are then able t...

The vulnerability of the software protection mechanism for accessing applications in Docker environments. IBM Security Verify Access Docker, a access control system from IBM Security Verify Access, has a flaw related to incorrect URL definition before file access. This allows attackers to elevate their privileges to the root level.

The vulnerability of the Docker-based application access control software, IBM Security Verify Access, stems from an incorrect definition of the link before accessing a file. Exploiting this vulnerability could allow attackers to elevate their privileges to the root level...

Huawei HarmonyOS and EMUI Unauthorized File Access Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. Huawei HarmonyOS and EMUI have an unauthorized file acces...

The vulnerability of the Foundation component of the macOS operating system, which allows a hacker to disclose protected information

The vulnerability of the Foundation component of the macOS operating system is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...

CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...

ownCloud Server < 10.13.3 Multiple Vulnerabilities

The version of ownCloud installed on the remote host is prior to 10.13.3. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in ownCloud owncloud/graphapi The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed,...

VulnCheck KEV: CVE-2020-11798

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...