CVE-2021-22571

A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above...

CVE-2021-22571

The CVE-2021-22571 issue affects Google SA360 WebQuery to BigQuery Exporter (SA360-webquery-bigquery). A local attacker could read files from other users’ SA360 reports stored in /tmp during staging before loading into BigQuery. Root cause centers on improper isolation of staged report files in /...

CVE-2022-22583: Undefined Security Weakness

A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files...

CVE-2022-22585: Improper Link Resolution Before File Access

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files...

CVE-2022-24075

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2022-24075

Whale browser prior to version 3.12.129.18 is affected: extensions can replace JavaScript files of the HWP viewer website, and the replaced script could read local HWP files when those files are opened. The connected documents confirm the same description; no remediation details are provided in t...

CVE-2022-24075

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2022-24075: Files or Directories Accessible to External Parties

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files...

CVE-2021-39703

CVE-2021-39703 affects Android 12 through a flaw in UsbDeviceManager.updateState that can cause unauthorized file access via a confused deputy, enabling local EoP with no extra execution privileges and no user interaction. Public fix references appear in Android security bulletins; patch levels 2...

CVE-2021-43957

Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9...

PT-2022-11955 · Atlassian · Fisheye/Crucible

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye & Crucible versions prior to 4.8.9 Description: The issue allows remote attackers to browse local files due to an Insecure Direct Object References IDOR vulnerability in the WEB-INF directory. This is possible because of a...

The vulnerability of the Windows Setup application installation process allows a hacker to exploit their privileges.

The vulnerability of the Windows Setup application’s installation service is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...

Atlassian Fisheye和Crucible 安全漏洞

Atlassian Fisheye is a suite of source code depth viewers.Crucible is a suite of code review tools. Atlassian Fisheye and Crucible contain a security vulnerability that can be exploited by an attacker to view arbitrary files on a system...

CVE-2021-24966

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder...

SUSE-SU-2022:0819-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.7.0 ESR bsc1196900: - CVE-2022-26383: Browser window spoof using fullscreen mode - CVE-2022-26384: iframe allow-scripts sandbox bypass - CVE-2022-26387: Time-of-check time-of-use bug when verifying add-...

Apple Xcode < 12.4 access to arbitrary files (macOS)

The version of Xcode running on the remote host is prior to 12.4. It is, Therefore, potentially affected by arbitrary file access as referenced in the vendor advisory. A remote attacker can exploit this to read arbitrary files and disclose sensitive information. %NASLMINLEVEL 70300 C Tenable...

DEBIAN-CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

Authentication flaw

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

PYSEC-2022-43170

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

UBUNTU-CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...