CVE-2023-35939 GLPI vulnerable to unauthorized access to Dashboard data

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

CVE-2023-34107

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue...

PYSEC-2023-108

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took...

PYSEC-2023-108

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took...

SUSE CVE-2023-2861

A flaw was found in the 9p passthrough filesystem 9pfs implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder...

PT-2023-21975 · Frauscher Sensortechnik Gmbh · Fds001

Name of the Vulnerable Software and Affected Versions: Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi versions 1.3.3 and earlier Description: The issue allows a remote attacker to read all files on the filesystem of the FDS001 device through a path traversal vulnerability of the web interface...

PT-2023-25314 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7183 Description: The issue allows admin users to exploit an XXE problem to view files. Recommendations: For versions prior to 7183, update to version 7183 or later to resolve the issue...

PT-2023-25716 · Fides · Fides

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.15.1 Description: A path traversal vulnerability affects Fides, allowing remote attackers to access arbitrary files on the Fides webserver container's filesystem. If the Fides webserver API is deployed behind a rever...

GLPI 安全漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

UBUNTU-CVE-2023-2861

A flaw was found in the 9p passthrough filesystem 9pfs implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder...

PT-2023-25454 · Intelbras · Intelbras Switch Sg 2404 Mr

Name of the Vulnerable Software and Affected Versions: Intelbras Switch SG 2404 MR version 1.00.54 Description: The issue is related to an authentication bypass that allows an unauthenticated attacker to download the device's backup file, exposing critical configuration information...

PT-2023-9188

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A flaw was found in the 9p passthrough filesystem 9pfs implementation. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape...

CVE-2023-33277

The CVE-2023-33277 issue affects Gira Giersiepen Gira KNX/IP-Router web interface versions 3.1.3683.0 and 3.3.8.0. A directory-traversal sequence in the URL allows a remote attacker to read sensitive files, exposing confidentiality (no integrity/availability impact reported). The vulnerability is...

PT-2023-24261 · Gira Giersiepen · Gira Knx/Ip-Router

Name of the Vulnerable Software and Affected Versions: Gira Giersiepen Gira KNX/IP-Router versions 3.1.3683.0 through 3.3.8.0 Description: The web interface of the affected device allows a remote attacker to read sensitive files via directory-traversal sequences in the URL. This issue enables...

PT-2023-24278 · Nec · Aterm Wg1800Hp +15

Name of the Vulnerable Software and Affected Versions: NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N affected versions not specified Description: The issue...

NEC Aterm WG2200HP 路径遍历漏洞

The NEC Aterm WG2200HP is a wireless router from Nippon Electric NEC. A security vulnerability exists in the NEC Aterm WG2200HP that stems from the presence of a directory traversal vulnerability that could allow an authenticated attacker to gain access to specific files in the product...

JVN#38343415: Multiple vulnerabilities in Aterm series

Aterm series provided by NEC Corporation contain multiple vulnerabilities listed below. Directory traversal CWE-22 - CVE-2023-3330 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N| Base Score: 2.6 CVSS v2| AV:A/AC:M/Au:S/C:P/I:N/A:N| Base Score: 2.3...

The vulnerability of the librenderdoc.so library, a standalone visual debugger for RenderDoc, allows attackers to increase their privileges.

The vulnerability of the librenderdoc.so library, a standalone visual debugger for RenderDoc, is related to an incorrect definition of symbolic references before accessing the file. Exploiting this vulnerability could allow an attacker to increase their privileges...

The vulnerability of NETGEAR RAX30 router microprogramming software lies in the improper handling of symbolic links before accessing the file, allowing attackers to disclose confidential information.

The vulnerability of NETGEAR RAX30 router microprogramming software is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to disclose confidential information...

Lenovo XClarity Administrator 代码问题漏洞

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product provides agentless hardware management for servers, storage, network switches, and more. A security vulnerability exists in Lenovo XClarity Administrator LXCA that originates from an...