RHEL 8 : samba (RHSA-2022:2074)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2074 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...

samba: Symlink race error can allow metadata read and modify outside of the exported share

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share...

Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

The field shortcode included with the plugin, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved With the...

Red Hat Enterprise Linux 竞争条件问题漏洞

Red Hat Enterprise Linux is a Linux operating system for business users from Red Hat, an American company. A security vulnerability exists in Red Hat Enterprise Linux that stems from a samba:symbolic link contention error could allow metadata to be read and modified outside of exported shares...

celery 命令注入漏洞

celery is an open source package for distributed task queues. A command injection vulnerability exists in celery versions prior to 5.2.2, which can be exploited by an attacker to access or somehow manipulate metadata in the celery backend, triggering a stored command injection vulnerability...

CVE-2021-24872 Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata...

Code injection

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints...

CVE-2021-24851

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status ie private, using a shortcode. Password protected posts/pages are not affected by such issue...

CVE-2021-24851

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status ie private, using a shortcode. Password protected posts/pages are not affected by such issue...

WordPress Get Custom Field Values plugin <= 3.9.4 - Arbitrary Post Metadata Access vulnerability

Arbitrary Post Metadata Access vulnerability discovered by Francesco Carlucci in WordPress Get Custom Field Values plugin versions = 3.9.4. Solution Update the WordPress Get Custom Field Values plugin to the latest available version at least 4.0...

CVE-2021-30867

The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata without needing permission to access photos...

Authentication flaw

The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata without needing permission to access photos...

CVE-2021-30867

The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata without needing permission to access photos...

Apple iOS 授权问题漏洞

Apple iOS is a set of operating systems developed for mobile devices by the American company Apple. Apple iOS 15 and iPadOS 15 previously had a security vulnerability that could allow malicious apps to access photo metadata without requiring a license...

[SECURITY] Fedora 33 Update: exiv2-0.27.3-7.fc33

A command line utility to access image metadata, allowing one to: print the Exif metadata of Jpeg images as summary info, interpreted value s, or the plain data for each tag print the Iptc metadata of Jpeg images print the Jpeg comment of Jpeg images set, add and delete Exif and Iptc metadata of...

Board metadata is viewable without permissions via IDOR - CVE-2020-36231

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References IDOR vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2. ...

Information disclosure

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-6312

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site...

Tecnick.com TCExam Information Disclosure Vulnerability

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is mainly used for online exams and more. A security vulnerability exists in Tecnick.com TCExam version 14.2.2. A remote attacker could exploit the vulnerability to access the test's metadata...

CVE-2018-13281

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager DSM before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the filepath parameter...