1461 matches found
Ministry of Defense Electronic Deliverables Creation Support Tool Security Breach
Ministry of Defense Electronic Deliverables Creation Support Tool is an electronic deliverables creation support tool from Ministry of Defense, Japan. A security vulnerability exists in Ministry of Defense Electronic Deliverables Creation Support Tool Construction Edition version 1.0.4, Electroni...
Electronic Delivery Check System Security Vulnerability
MAFF Electronic Delivery Check System is an electronic delivery check system from MAFF Japan. A security vulnerability exists in Electronic Delivery Check System Ver.14.0.001.002 and earlier versions, which stems from the handling of specially crafted XML files that may lead to the exposure of...
Directory Traversal
fastify-swagger-ui is vulnerable to Directory Traversal. The vulnerability is caused due to a default configuration issue in @fastify/swagger-ui .If the baseDir option is not set, the module exposes all files in its directory through the HTTP route it serves. This allows an attacker to gain...
CVE-2024-22207
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of "@fastify/swagger-ui" without "baseDir" set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Settin...
CVE-2024-0191 RRJ Nueva Ecija Engineer Online Portal file information disclosure
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/uploads/. The manipulation leads to file and directory information exposure. It is possible to launch the attack remotely. The exploit...
CVE-2024-0191
The CVE-2024-0191 entry concerns RRJ Nueva Ecija Engineer Online Portal 1.0. Affects an unknown function under the /admin/uploads/ path, enabling remote disclosure of file and directory information. Public exploit details exist, indicating potential remote abuse with low attack complexity and no ...
PT-2023-27900 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.3 Description: The issue allows unauthenticated access through the API endpoints "/api/snapshot" and "/api/get log file". This could potentially lead to a DoS attack or allow an attacker to retrieve arbitrary...
Race Condition (Leaky Vessels)
Overview Affected versions of this package are vulnerable to Race Condition Leaky Vessels in the subpath mounting when two malicious build steps are running in parallel and sharing the same cache mounts. This can lead to files from the host system being accessible to the build container. Workarou...
Code injection
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data...
VulnCheck KEV: CVE-2019-17503
An issue was discovered in Kirona Dynamic Resource Scheduling DRS 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd aka /osmtiles/REGISTER.cmd directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database...
BVRP Software Avanquest Software SLmail Security Breach
BVRP Software Avanquest Software SLmail BVRP Software SLmail is an e-mail server solution from BVRP Software, France. A security vulnerability exists in BVRP Software Avanquest Software SLmail version 5.5.0.4433, which originates from the ability to retrieve credentials files, configuration files...
Multiple vulnerabilities in EXPRESSCLUSTER X
Overview WebManager/Cluster WebUI of EXPRESSCLUSTER X provided by NEC Corporation contains multiple vulnerabilities listed below. Missing authorization CWE-862 - CVE-2023-39544 Files or directories accessible to external parties CWE-552 - CVE-2023-39545 Use of password hash instead of password fo...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Themeisle Cloud_Templates_\&_Patterns_Collection
CVE-2023-47529 Cloud Templates & Patterns collection =...
CVE-2023-46851
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remot...
Remote code execution
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remot...
PT-2023-30242 · Apache · Apache Allura
Name of the Vulnerable Software and Affected Versions: Apache Allura versions 1.0.1 through 1.15.0 Description: The issue allows project administrators to import attachments with unrestricted URL values, potentially causing Apache Allura to read local files and expose them. This exposure can lead...
Fedora 39 : python-jupyter-server (2023-3d77cfc654)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d77cfc654 advisory. Security update with fixes for CVE-2023-39968 and CVE-2023-40170 Tenable has extracted the preceding description block directly from the Fedora...
CVE-2023-27256
Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers...
