Debian dla-3436 : libipa-hbac-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3436 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3436-2 [email protected] https://www.debian.org/lts/security/...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js

Summary Multiple vulnerabilities in Node.js used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2019-16777 DESCRIPTION: npm CLI could allow a local attacker to bypass security restrictions, caused by the failure to prevent existing globally-installed binaries...

PT-2023-16975 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web WordPress plugin versions prior to 1.8.15 Description: The issue allows high privilege users to upload files outside of the intended uploads folder due to a path traversal vector, potentially enabling them to place...

Jenkins: Temporary plugin file created with insecure permissions

A flaw was found in Jenkins. Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer. If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in...

Path traversal

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution...

CVE-2023-29478

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution...

CVE-2023-29478

CVE-2023-29478 affects BiblioCraft before 2.4.6. The root cause is failure to sanitize path-traversal characters in filenames, allowing restricted write access across the filesystem (including the Minecraft mods folder) and enabling code execution. Reported in multiple feeds (NVD/Red Hat) with a ...

CBL Mariner 2.0 Security Update: podman (CVE-2022-1227)

The version of podman installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1227 advisory. - A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to...

CBL Mariner 2.0 Security Update: kubevirt (CVE-2022-1798)

The version of kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1798 advisory. - A path traversal vulnerability in KubeVirt versions up to 0.56 and 0.55.1 on all platforms allows a user ab...

CVE-2023-25261

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer Desktop 2023.1.4 and Stimulsoft Designer Web 2023.1.3 and Stimulsoft Viewer Web 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include sour...

CVE-2023-26256

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system...

Jira plugin STAGIL Navigation 路径遍历漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. A security vulnerability exists in Jira plugin STAGIL Navigation prior to version 2.0.52, which stems from the presence o...

Jira plugin STAGIL Navigation 路径遍历漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. A security vulnerability exists in Jira plugin STAGIL Navigation prior to version 2.0.52, which stems from the presence o...

K50343630: iAppsLX REST vulnerability CVE-2020-27727

Security Advisory Description When an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem. CVE-2020-27727 Impact An attacker can exploit this vulnerability as...

K8178: MySQL vulnerabilities CVE-2007-5925, CVE-2007-5969, and CVE-2007-6303

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

Protect

A clear text storage of sensitive information CWE-312 vulnerability in both FortiGate and FortiAuthenticator may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via...

SUSE CVE-2017-1000387

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

SUSE CVE-2019-3835

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER...

SUSE CVE-2019-3839

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscrip...