GHSA-5PR9-V234-JW36 Remote Code Execution via traversal in TAL expressions

Impact Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python...

SAP Business One Information Disclosure Vulnerability (CNVD-2021-42413)

SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. An information disclosure vulnerability exists in SAP Business One version 10.0, which can be exploited by an...

Duplicate Advisory: Path Traversal in Zope

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5pr9-v234-jw36. This link is maintained to preserve external references. Original Description Zope is an open-source web application server. This advisory extends the previous advisory at...

CVE-2021-33662

Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted...

Adobe After Effects Out-of-Bounds Read Vulnerability (CNVD-2021-41064)

Adobe After Effects referred to as "AE" is a graphic video processing software from Adobe, suitable for organizations engaged in design and video stunts, including television stations, animation production companies, individual post-production studios and multimedia studios. An out-of-bounds read...

SUSE: Security Advisory (SUSE-SU-2019:2460-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution via traversal in TAL expressions

This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Impact Most Python modules are not available for using in TAL expressions that you can add...

CVE-2021-27657: Improper Privilege Management

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:0825-1 Rating: important References: 1186458 Cross-References: CVE-2021-21212 CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528...

Firejail: Privilege escalation

Background A SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. Description It was discovered that a flaw in Firejail’s OverlayFS code allowed restricted programs to escape sandbox. Impac...

CVE-2021-21001

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges...

Design/Logic Flaw

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges...

CVE-2021-21001

Summary: CVE-2021-21001 affects WAGO PFC200 devices. An attacker with network access can exploit specially crafted packets to access the device filesystem with higher privileges, via a path-traversal weakness that restricts access to a directory. Affected component/impact: path traversal on WAGO ...

CVE-2021-21001: Improper Limitation of a Pathname to a Restricted Directory

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges...

PT-2021-3332 · Wago · Wago Pfc 200

Name of the Vulnerable Software and Affected Versions: WAGO PFC200 devices affected versions not specified Description: The issue is related to the WAGO PFC200 devices, where an authorized attacker with network access can access the file system with higher privileges using specially crafted...

CVE-2021-21001

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges...

Debian DSA-4917-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2021-30506 @retsew0x01 discovered an error in the Web App installation interface. - CVE-2021-30507 Alison Huffman discovered an error in the Offline mode. - CVE-2021-30508 Leecraso and Guang Gong discovered a buffer...

Adobe Acrobat/Reader Out-of-Bounds Read Vulnerability (CNVD-2021-49207)

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat/Reader has an out-of-bounds read vulnerability. An attacker can exploit this vulnerability to read arbitrary file systems...

CVE-2021-29475

HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability t...

CVE-2021-21070 Privilege Escalation Vulnerability in Adobe RoboHelp

Adobe Robohelp version 2020.0.3 and earlier is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with admin permissions to write to the file system could leverage this vulnerability to escalate privileges...