CVE-2023-2800 Insecure Temporary File in huggingface/transformers

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

RHEL 8 : postgresql-jdbc (RHSA-2023:2867)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2867 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs ...

PT-2023-22353 · Extplorer · Extplorer

Name of the Vulnerable Software and Affected Versions: eXtplorer version 2.1.15 Description: The issue allows for insecure permissions, specifically through the file upload feature in the file manager. This vulnerability enables the upload of zip files that contain PHP pages, which can lead to...

CVE-2023-24507

AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request...

Design/Logic Flaw

AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request...

CVE-2023-24507 AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload

AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request...

CVE-2023-24507 AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload

AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request...

AgilePoint NX 代码问题漏洞

AgilePoint NX is a cloud-based digital transformation platform from AgilePoint Japan that enables enterprise-grade BPMS with no-code and low-code speed and agility. A security vulnerability exists in AgilePoint NX v8.0 SU2.2 & SU2.3. An attacker exploits the vulnerability to perform an insecure...

CVE-2023-24507

Affected software: AgilePoint NX v8.0 SU2.2 and SU2.3. Vulnerability type: Insecure file upload. Details provided: Vulnerability allows insecure file upload via an unspecified request. The available sources do not reveal technical specifics beyond the insecure upload vector, root cause, or exact ...

MilleGPG5 5.9.2 Local Privilege Escalation Vulnerability

Exploit Title: MilleGPG5 5.9.2 Gennaio 2023 - Local Privilege Escalation / Incorrect Access Control Exploit Author: Andrea Intilangelo Vendor Homepage: https://millegpg.it/ Software Homepage: https://millegpg.it - https://millewin.it/prodotti/governo-clinico-3/ Software Link:...

MilleGPG5 5.9.2 Local Privilege Escalation

Exploit Title: MilleGPG5 5.9.2 Gennaio 2023 - Local Privilege Escalation / Incorrect Access Control Date: 2023-04-28 Exploit Author: Andrea Intilangelo Vendor Homepage: https://millegpg.it/ Software Homepage: https://millegpg.it - https://millewin.it/prodotti/governo-clinico-3/ Software Link:...

CVE-2023-1731

The CVE-2023-1731 issue affects Meinberg LTOS prior to v7.06.013, where the configuration file upload function does not properly validate input. This allows a remote authenticated attacker with high privileges to execute arbitrary commands (remote code execution). Affected product is Meinberg LTO...

Medium: docker

Issue Overview: A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup. CVE-2022-36109 Docker version 20.10.15, build fd82621 is vulnerable to Insecure Permissions. Unauthorized users outside the Docker...

Design/Logic Flaw

Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleanerDebug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link...

CVE-2023-28892

Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleanerDebug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description High SECURITY-3037 / CVE-2023-27898 XSS vulnerability in plugin manager Medium SECURITY-3030 / CVE-2023-24998 upstream issue, CVE-2023-27900 MultipartFormDataParser, CVE-2023-27901 StaplerRequest DoS vulnerability in bundled Apache Commons FileUpload library...

Privilege escalation

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...

Insecure Temporary Files

org.jboss.resteasy, resteasy-jaxrs-all is vulnerable to Insecure Temporary Files. The vulnerablity is due to using insecure file creation function File.createTempFile while creating temporary files. This can lead to attacker read/modify/write temporary files resulting in sensitive information...

Duplicate Advisory: Insecure Temporary File in RESTEasy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2c6g-pfx3-w7h8. This link is maintained to preserve external references. Original Description In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround...

PT-2023-16295 · Resteasy +4 · Resteasy +4

Name of the Vulnerable Software and Affected Versions: RESTEasy versions prior to 7.0.0.Alpha1 RESTEasy versions prior to 6.2.3.Final RESTEasy versions prior to 5.0.6.Final RESTEasy versions prior to 4.7.8.Final RESTEasy versions prior to 3.15.5.Final Description: The issue arises from the use of...