FatPipe MPVPN < 10.1.2r60p92 / 10.2.2 < 10.2.2r44p1 Configuration File Upload (CVE-2021-27860)

According to its self-reported version, the instance of FatPipe MPVPN running on the remote web server is 10.1.2r60p92 or 10.2.2 10.2.2r44p1. It is, therefore, affected by a configuration file upload vulnerability that could allow a remote attacker to upload a file to any location on the filesyst...

Amazon Linux AMI : kernel (ALAS-2023-1744)

The version of kernel installed on the remote host is prior to 4.14.314-164.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1744 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inod...

Craft CMS vulnerable to Remote Code Execution via unrestricted file extension

Summary Unrestricted file extension lead to a potential Remote Code Execution Authenticated, ALLOWADMINCHANGES=true Details Vulnerability Cause : If the name parameter value is not empty string'' in the View.php's doesTemplateExist - resolveTemplate - resolveTemplateInternal - resolveTemplate...

GHSA-VQXF-R9PH-CC9C Craft CMS vulnerable to Remote Code Execution via unrestricted file extension

Summary Unrestricted file extension lead to a potential Remote Code Execution Authenticated, ALLOWADMINCHANGES=true Details Vulnerability Cause : If the name parameter value is not empty string'' in the View.php's doesTemplateExist - resolveTemplate - resolveTemplateInternal - resolveTemplate...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20087

Summary: CVE-2023-20087 affects Cisco Identity Services Engine (ISE) where the web-based management interface contains input-validation errors that could let an authenticated, remote attacker download arbitrary files from the device filesystem by sending crafted HTTP requests. This is supported b...

CVE-2023-20077

CVE-2023-20077 affects Cisco Identity Services Engine (ISE). The web-based management interface contains input-validation vulnerabilities that allow an authenticated, remote attacker to download arbitrary files from the device filesystem by sending crafted HTTP requests. Impact is confirmed as ar...

CVE-2023-20077 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20087 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20087 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js

Summary Multiple vulnerabilities in Node.js used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2019-16777 DESCRIPTION: npm CLI could allow a local attacker to bypass security restrictions, caused by the failure to prevent existing globally-installed binaries...

Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Medium: kernel

Issue Overview: A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors. CVE-2023-2513 qfqchangeclass in...

EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2023-1902)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function...

CVE-2023-2124

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

The vulnerability of the `composite_dev_prepare()` function in the `drivers/usb/gadget/function/f_accessory.c` file of the USBFS file system driver for the Android operating system’s kernel allows a hacker to escalate their privileges.

The vulnerability of the compositedevprepare function in the drivers/usb/gadget/function/faccessory.c file of the USBFS file system driver for the Android operating system’s kernel is related to the lack of checks on buffer size. Exploiting this vulnerability could allow an attacker to increase...