Multiple vulnerabilities in untangle

Overview untangle provided by Christian Stefanescu is a Python library for processing XML documents. untangle contains multiple vulnerabilities listed below. Improper Restriction of Recursive Entity References in DTDs CWE-776 - CVE-2022-33977 Improper Restriction of XML External Entity Reference...

CVE-2022-31202

The export function in SoftGuard Web SGW before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl...

CVE-2022-31202

The export function in SoftGuard Web SGW before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl...

PT-2022-20609

Name of the Vulnerable Software and Affected Versions SoftGuard Web SGW versions prior to 5.1.5 Description The issue allows directory traversal, enabling the reading of arbitrary local files via the export function or man.tcl. Recommendations For versions prior to 5.1.5, update to version 5.1.5 ...

CVE-2022-31202: Improper Limitation of a Pathname to a Restricted Directory

The export function in SoftGuard Web SGW before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl...

CVE-2020-4138

IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049...

CVE-2020-4138

IBM SiteProtector Appliance 3.1.1 is affected by CVE-2020-4138, which allows web pages to be stored locally and read by another user on the same system. The issue is documented in NVD and IBM's security bulletin; affected product/version is IBM SiteProtector system 3.1.1. Remediation: apply the e...

Security Bulletin: IBM Security SiteProtector System is affected by multiple vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in a Core XPU. Vulnerability Details CVEID:CVE-2020-4150 DESCRIPTION: IBM SiteProtector Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound...

U.S. Dept Of Defense: Local File Read vulnerability on ██████████ [HtUS]

Kindly check screenshot ███████: In case if scope question. Because i picked this site from DOD website list under 'dod sites'. Lets move on to the bug now : Summary: Local File Include vulnerability on ███. Oracle Ebs Bispgrapgh is prone to a directory traversal vulnerability that can be exploit...

Access Restriction Bypass

Overview ruby-mysql is a MySQL connector. pure Ruby version Affected versions of this package are vulnerable to Access Restriction Bypass. A malicious MySQL server can request local file content from a client using without explicit authorization from the user. Remediation Upgrade ruby-mysql to...

Ruby ruby-mysql 安全漏洞

Ruby ruby-mysql is a pure Ruby version of the MySQL connector from the Ruby community.An access control error vulnerability exists in Ruby ruby-mysql Gem versions prior to 2.10.0, which stems from the fact that a malicious MySQL server can request local file content from a client without explicit...

PT-2022-15277 · Parse-Url · Url-Parse

Name of the Vulnerable Software and Affected Versions: parse-url versions prior to 7.0.0 Description: The issue is related to Server-Side Request Forgery SSRF in the parse-url repository. This allows for the exploitation of parse URL to read local files. Recommendations: For versions prior to...

CVE-2021-20551

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149...

CVE-2021-20551

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149...

CVE-2021-20551

CVE-2021-20551 affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2, where web pages can be stored locally and read by another user on the same system, causing information disclosure. The issue originates from local storage of sensitive content via browsers/cache as describ...

CVE-2021-20551: Exposure of Resource to Wrong Sphere

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149...

GHSA-R3RG-JRJQ-W4MR Grav CMS Local File Injection

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...

CVE-2022-31261

An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker ca...

CVE-2022-31261: Improper Restriction of XML External Entity Reference

An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker ca...

CVE-2020-8793

OpenSMTPD before 6.6.4 allows local users to read arbitrary files e.g., on some Linux distributions because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c...