CVE-2023-38344: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...

Netcon NS-ASG Security Vulnerability

Netcon NS-ASG is an application security gateway from China Netcon Technology Netcon. A security vulnerability exists in Netcon NS-ASG version 6.3, which stems from vulnerability to incorrect access control and file disclosure of the Application Security Gateway website source code...

MGASA-2023-0259 Updated librsvg packages fix security vulnerability

A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. CVE-2023-3863...

OESA-2023-1623 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ManageEngine ADManager Plus < Build 7203 File Disclosure

Zoho ManageEngine ADManager Plus before version 7.2 Build 7203 is affected by a file disclosure vulnerability that allows admin users to download any file from the server machine via directory traversal. Note that Nessus has not tested for this issue but has instead relied only on the application...

Oracle Linux 8 : firefox (ELSA-2020-2031)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2031 advisory. 68.8.0-1.0.1.el82 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 - Add firefox-oracle-default-prefs.js and remove the corresponding Red...

Oracle Linux 8 : openwsman (ELSA-2019-0972)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0972 advisory. - Fix CVE-2019-3816 Resolves: 1693972 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

CVE-2015-2201

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

Design/Logic Flaw

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

CVE-2015-2201: Improper Neutralization of Special Elements used in an OS Command

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

CVE-2015-2201

Aruba AirWave contains a vulnerability in VisualRF that permits remote OS command execution and file disclosure by administrative users in affected releases. Affected versions are Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7. The issue is triggered through VisualRF components and could lead...

CVE-2015-2201

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

PT-2023-10313 · Aruba · Aruba Airwave

Name of the Vulnerable Software and Affected Versions: Aruba AirWave versions 7.7.14.1 and earlier Aruba AirWave versions 8.0.6 and earlier Description: The issue allows remote OS command execution and file disclosure by administrative users through VisualRF. Recommendations: For Aruba AirWave...

CVE-2015-2201

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

Aruba Networks Airwave Operating System Command Injection Vulnerability

Aruba Networks Airwave is a software from Aruba Networks that visualizes, tracks, and manages wired wireless networks. A security vulnerability exists in Aruba Networks Airwave versions prior to 7.7.14.2, 8.x through 8.0.7. An attacker could exploit the vulnerability to remotely execute operating...

Important: librsvg2

Issue Overview: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include elemen...

Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...