Improper Link Resolution Before File Access in pip

pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory...

GHSA-RVMG-XC29-RVXF Luracast Restler directory traversal vulnerability

Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter...

Luracast Restler directory traversal vulnerability

Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter...

Luracast Restler directory traversal vulnerability

Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter...

PT-2022-25605

Name of the Vulnerable Software and Affected Versions SolarView Compact version 6.00 Description A command injection issue was discovered via the network test.php file. Recommendations For SolarView Compact version 6.00, as a temporary workaround, consider restricting access to the network test.p...

Cambium Networks cnMaestro 路径遍历漏洞

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from a path traversal vulnerability that stems from cnMaestro's susceptibility to an arbitrary file write attack. An attacker...

CVE-2022-29845

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file...

Code injection

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file...

CVE-2022-29845

Summary: CVE-2022-29845 affects Progress Ipswitch WhatsUp Gold versions 21.1.0–21.1.1 and 22.0.0. An authenticated user can trigger an API transaction to read the contents of a local file. The Red Hat and CVE CN/CZ records corroborate this issue with the same description. The Metasploit entry sho...

CVE-2022-29845

In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file...

OESA-2022-1641 perl-DBI security update

The DBI is the standard database interface module for Perl.It defines a set of methods, variables and conventions that providea consistent database interface independent of the actual database being used.It is important to remember that the DBI is just an interface.The DBI is a layer of "glue"...

fapolicyd security, bug fix, and enhancement update

An update is available for fapolicyd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Fapolicyd File Access Policy Daemon implements application whitelisting to...

Moderate: fapolicyd security, bug fix, and enhancement update

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...

ALSA-2022:1898 Moderate: fapolicyd security, bug fix, and enhancement update

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...

Denial Of Service (DoS)

github.com/fluxcd/kustomize-controller is vulnerable to denial of service. An attacker can access files outside the expected directory via a malicious kustomization.yaml and cause an application crash at the controller level...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2022-0009)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by...

CVE-2021-43816

An incorrect permission assignment flaw was found in containerd. This flaw allows a local attacker to use a specially designed text file to read and write files outside of the container's scope...

CVE-2022-29180: Server-Side Request Forgery (SSRF)

A vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched and is available in release v0.12.1. We recommend that all users running self-hosted charm instances update immediately. This...

PT-2022-18743 · 3Cx · 3Cx Phone System Management Console

Name of the Vulnerable Software and Affected Versions: 3CX Phone System Management Console versions prior to 18 Update 3 FINAL Description: An issue was discovered in the 3CX Phone System Management Console, where an unauthenticated attacker could abuse improperly secured access to arbitrary file...

3CX Phone system（web）management console 安全漏洞

The 3CX Phone is a software-based private branch exchange. It can be used with SIP standard based IP phones, SIP trunks and VoIP gateways to provide a complete communication solution. A security vulnerability exists in 3CX Phone system web management console version 18.0. An attacker could exploi...