Apache James 信息泄露漏洞

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java from the Apache Foundation in the U.S. An authorization issue vulnerability exists in Apache James, which stems from a vulnerability in the MIME4J TempFileStorageProvider using improperl...

PT-2023-14754

Name of the Vulnerable Software and Affected Versions Apache James MIME4J versions prior to 0.8.9 Description Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. Recommendations For Apache James MIME4J...

Amazon Linux 2 : samba, --advisory ALAS2-2021-1649 (ALAS-2021-1649)

The version of samba installed on the remote host is prior to 4.10.16-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1649 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

IBM Navigator for I SQL Injection Vulnerability

IBM Navigator for i is a console interface used in IBMi by International Business Machines IBM to perform and manage critical tasks in IBMi. IBM Navigator for i is vulnerable to SQL injection in versions 7.3, 7.4, and 7.5. The vulnerability stems from the application's lack of validation of...

CVE-2022-43859

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface. IBM X-Force ID:...

Sql injection

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface. IBM X-Force ID:...

CVE-2022-43859 IBM Navigator for i SQL injection

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface. IBM X-Force ID:...

CVE-2022-43859 IBM Navigator for i SQL injection

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface. IBM X-Force ID:...

PT-2022-7106 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.3 through 7.5 Description: The issue is related to the lack of protection for the SQL query structure in the IBM Navigator graphical interface of the IBM i operating system. This could allow a remote attacker to...

IBM Navigator for i SQL注入漏洞

IBM Navigator for i is a console interface used in IBMi by International Business Machines IBM to perform and manage critical tasks in IBMi. IBM Navigator for i is vulnerable to SQL injection in versions 7.3, 7.4, and 7.5. The vulnerability stems from the application's lack of validation of...

SilverStripe Subsite weakens file permissions

The subsites module can weaken edit restrictions on some files and allow a malicious user to edit files they do not have edit rights to. This only affects projects with the subsites module installed. Regression testing should focus on custom file logic. Be advised that this is not a case of a use...

GHSA-CX45-565Q-6QX8 SilverStripe Subsite weakens file permissions

The subsites module can weaken edit restrictions on some files and allow a malicious user to edit files they do not have edit rights to. This only affects projects with the subsites module installed. Regression testing should focus on custom file logic. Be advised that this is not a case of a use...

CVE-2022-42949 - Subsite weakens file permissions

More info at https://www.silverstripe.org/download/security-releases/cve-2022-42949...

Siemens Simcenter STAR-CCM Privilege Elevation Vulnerability

Siemens Simcenter STAR-CCM is a complete multi-physics field solution from Siemens Germany that simulates products and designs working under real-world conditions. a security vulnerability exists in Siemens Simcenter STAR-CCM, which stems from improperly assigning file permissions to installation...

CVE-2022-43517

A vulnerability has been identified in Simcenter STAR-CCM+ All versions V2306. The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain...

CVE-2022-43517

A vulnerability has been identified in Simcenter STAR-CCM+ All versions V2306. The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain...

CVE-2022-43517

A vulnerability has been identified in Simcenter STAR-CCM+ All versions V2306. The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain...

CVE-2022-43517

CVE-2022-43517 – Simcenter STAR-CCM+ affects all versions prior to V2306. The vulnerability arises from incorrect file/installation-folder permissions, enabling a local unprivileged user to override or modify service executables and gain elevated privileges (CVSS v3.1 base score 7.8). Public refe...

CVE-2022-3881

CVE-2022-3881 concerns the WordPress WPTools plugin, affected versions before 3.43. The issue is improper authorization and CSRF in an AJAX action, allowing any authenticated user (e.g., a subscriber) to install and activate arbitrary plugins from wordpress.org. Root cause: missing CSRF/authoriza...

CVE-2022-3881: Cross-Site Request Forgery (CSRF)

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and...