CVE-2022-27226

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

Cross site request forgery (csrf)

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

CVE-2022-27226

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

PT-2022-2960

Name of the Vulnerable Software and Affected Versions iRZ Mobile Routers through 2022-03-16 Description A CSRF issue in "/api/crontab" allows a threat actor to create a crontab entry in the router administration panel. The cronjob will execute the entry on the threat actor's defined interval,...

CVE-2022-27226: Cross-Site Request Forgery (CSRF)

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat...

CVE-2022-25247

Axeda agent All versions and Axeda Desktop Server for Windows All versions may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and...

CVE-2022-27218

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

PT-2022-2076

Name of the Vulnerable Software and Affected Versions Any23 versions prior to 2.7 Description An XML external entity XXE injection issue was discovered in the Any23 RDFa XSLTStylesheet extractor. This issue allows an attacker to interfere with an application's processing of XML data, potentially...

CVE-2021-43070

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

PT-2022-9873

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions before 8.0.1b Brocade Fabric OS versions before 7.4.1d Description A vulnerability could allow an authenticated attacker within the restricted shell environment rbash as either the user or factory account, to read th...

CVE-2022-24683

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or job-submit capabilities to read arbitrary files on the host filesystem as root...

Design/Logic Flaw

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or job-submit capabilities to read arbitrary files on the host filesystem as root...

MGASA-2022-0055 Updated firejail packages fix security vulnerability

private-cwd leaks access to the entire filesystem...

Updated firejail packages fix security vulnerability

private-cwd leaks access to the entire filesystem...

PT-2022-37561

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue allows private-cwd leaks, which provide access to the entire filesystem. Recommendations At the moment, there is no information about a newer version that contains a fix for thi...

Cross-site Request Forgery (CSRF)

github.com/filebrowser/filebrowser is vulnerable to cross-site request forgery. The vulnerability exists due to a lack of validation when creating a user with admin privilege allowing an attacker get access to filesystem via a maliciously crafted HTML webpage...

CVE-2021-46398

A Cross-Site Request Forgery vulnerability exists in Filebrowser 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads...

CVE-2021-29398: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application...

Apple Pays $100.5K Bug Bounty for Mac Webcam Hack

A researcher who showed Apple how its webcams can be hijacked via a universal cross-site scripting bug UXSS Safari bug has been awarded what is reportedly a record $100,500 bug bounty. The bug could be used by an adversary as part of an attack to gain full access to every website ever visited by...