Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read

Description The plugin doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file. PoC As ...

HPESBNW04527 rev.2 - Multiple Vulnerabilities in HPE Aruba Networking Virtual Intranet Access (VIA) Windows Client

Potential Security Impact: Local: Creation and Deletion of Arbitrary Files, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Intranet Access VIA Windows Client Only - All versions 4.5 and lower CVSS Scores: | CVE | CVSS Vector | Base Score | |...

Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read

Description The plugin doesn't validate the fileurl parameter when importing a CSV file, allowing high privilege users with the managewoocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file. As an...

CVE-2023-39403

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39399

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39400

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

Authorization

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39402

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39400

CVE-2023-39400 is a parameter verification vulnerability in the installd module. Multiple connected sources describe it as allowing unauthorized access to sandbox files by reading and writing them, with the issue being exploitable remotely (network) and requiring no user interaction; the impact i...

Google Chrome Security Bypass Vulnerability (CNVD-2023-63444)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome versions prior to 108.0.5359.71 due to an improper implementation in DevTools. An attacker can use this vulnerability to bypass file access restrictions to install malicious...

PT-2023-4419

Name of the Vulnerable Software and Affected Versions Apache Airflow Drill Provider versions prior to 2.4.3 Description The issue is related to improper input validation in Apache Airflow Drill Provider, allowing an attacker to pass malicious parameters when establishing a connection with...

i2soft CMS 2.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : i2soft CMS v2.0 Insecure Direct Object Reference Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

The vulnerability of the DevTools set of tools for web development in the Google Chrome browser allows a hacker to gain access to and modify files.

The vulnerability of the DevTools set of tools for web development in the Google Chrome browser is related to an incorrect path limitation for accessing restricted directories. Exploiting this vulnerability could allow a malicious actor to remotely access and modify files by downloading a special...

CVE-2023-30701

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

CVE-2023-30701

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

Design/Logic Flaw

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

CVE-2023-30701

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

CVE-2023-30701

PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access...

PT-2023-22901 · Unknown · Wifigeofencemanager

Name of the Vulnerable Software and Affected Versions: WifiGeofenceManager versions prior to SMR Aug-2023 Release 1 Description: The issue allows a local attacker to gain arbitrary file access through PendingIntent hijacking in the WifiGeofenceManager. Recommendations: For versions prior to SMR...

GHSA-HPF4-V7V2-95P2 PrestaShop file access through path traversal

Impact displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. This vulnerability can be exacerbated when coupled with CWE-502, which pertains to the Deserialization of Untrusted Data. Such a...