PT-2023-31173 · Unknown +3 · Budgie Extras Clockworks Applet +3

Name of the Vulnerable Software and Affected Versions: Budgie Extras Clockworks applet affected versions not specified Description: Temporary data passed between application components by the Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a...

Repox Security Vulnerability

Repox is a framework for managing data spaces from Repox. A security vulnerability exists in Repox 2.3.7 and earlier versions, which stems from the presence of a path traversal vulnerability. The vulnerability can be exploited by an attacker to read arbitrary files on the server, thereby disclosi...

CVE-2023-50263

CVE-2023-50263 (Nautobot) describes an information disclosure vulnerability where unauthenticated access to file storage URLs /files/get/?name=… and /files/download/?name=… is possible in Nautobot 1.x and 2.0.x before 1.6.7 and 2.0.6. The issue stems from the default Django-db-file-storage implem...

PT-2023-30514 · Relyum · Rely-Pcie

Name of the Vulnerable Software and Affected Versions: Relyum RELY-PCIe version 22.2.1 Description: The issue is related to a system group misconfiguration in Relyum RELY-PCIe devices, which allows read access to the central password hash file of the operating system. Recommendations: For Relyum...

PT-2023-9245 · Unknown · Masterscada

Name of the Vulnerable Software and Affected Versions: MasterSCADA version 4D Description: The issue is related to weaknesses in the authorization procedure of the SCADA system. Exploitation of this issue may allow a remote attacker to read and write arbitrary files. Recommendations: For...

CVE-2023-41113

An issue was discovered in EnterpriseDB Postgres Advanced Server EPAS before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to to obtain information about whether certain files exist on disk, what errors if any occ...

PT-2023-31040 · Sap · Sap Master Data Governance

Name of the Vulnerable Software and Affected Versions: SAP Master Data Governance affected versions not specified Description: The issue allows an attacker to exploit insufficient validation of path information provided by users. This can lead to characters representing 'traverse to parent...

The vulnerability of the Apache Struts software platform, related to the use of files and directories accessible from external parties, allows a hacker to execute arbitrary code.

The vulnerability of the Apache Struts software platform is related to the use of files and directories accessible from external parties due to incorrect restrictions on the path to the restricted directory during file loading. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2023-47440

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine...

etcd Security Vulnerabilities

etcd is a key-value storage system for distributed systems written in the Go language. A security vulnerability exists in version 87ae63d75260 of etcd-browser, which stems from an issue found in server.js, where a remote server port specified during installation can be traversed by sending a GET...

CVE-2023-49248

Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access...

CVE-2023-49248

CVE-2023-49248 affects Huawei HarmonyOS, specifically the Settings application. The vulnerability is described as a file override access issue that can lead to unauthorized file access. Connected documents corroborate the issue title and impact but do not provide concrete remediation steps or add...

CVE-2023-49108

Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 excluding Ver.6.1.1.3a. If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges...

Internet Bug Bounty: ASAR Integrity bypass via filetype confusion

A vulnerability was discovered in Electron that allowed bypassing ASAR integrity checks via filetype confusion. Maliciously crafted directories could trick apps into loading non-validated code. This impacted apps with certain fuses enabled on macOS that relied on filesystem protections. The issue...

RakRak Document Plus vulnerable to path traversal

Overview RakRak Document Plus provided by Sumitomo Electric Information Systems Co., Ltd. contains a path traversal vulnerability CWE-22. Asato Masamu of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

PT-2023-32679 · Thecosy · Thecosy Icecms

Name of the Vulnerable Software and Affected Versions: Thecosy IceCMS version 2.0.1 Description: A vulnerability was found in the User Comment Handler component, affecting unknown code of the file /planet. The manipulation leads to cross site scripting. The attack can be initiated remotely...

VulnCheck KEV: CVE-2021-43798

Grafana contains a path traversal vulnerability that could allow access to local files...

CVE-2023-6352

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

CVE-2023-6343

The CVE describes a vulnerability in Tyler Technologies Court Case Management Plus related to the Aquaforest TIFF Server used for handling TIFF files. Affected component: Aquaforest TIFF Server (integrated via Tyler’s court management solution). Vulnerability occurs in TIFF Server features access...

Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems

CISA has assisted a researcher with coordinating the disclosure of multiple researcher-discovered vulnerabilities affecting web-based case and document management systems used by multiple state, county, and municipal courts. Affected systems include products from Tyler Technologies and Catalis an...