The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire, related to the possibility of bypassing the path, allows attackers to increase their privileges.

The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire is related to the possibility of bypassing the authentication process. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

PT-2023-27228 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 3.8.15 Craft versions prior to 4.4.15 Description: The issue is related to bypassing the validatePath function, which can lead to potential remote code execution. This can result in malicious control of vulnerable...

CVE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

CVE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

CVE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

postgresql: schema_element defeats protective search_path changes

A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code...

The vulnerability in the Roxy-WI server management web interface, related to the possibility of bypassing the path that allows attackers to access protected information.

The vulnerability in the Roxy-WI server management web interface is related to the possibility of bypassing the path. Exploiting this vulnerability allows a malicious actor to gain access to protected information...

UBUNTU-CVE-2023-27534

A path traversal vulnerability exists in curl 8.0.0 SFTP implementation causes the tilde character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can...

SUSE CVE-2019-9854

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

SUSE CVE-2019-11044

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access...

django: potential bypass of an upstream access control based on URL paths

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths...

The vulnerability of Hirschmann Industrial HiVision’s network management software lies in its ability to bypass the path, allowing an intruder to execute arbitrary code.

The vulnerability of Hirschmann Industrial HiVision’s network management software lies in its ability to bypass security measures. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of the `Validator.getValidDirectoryPath(String, String, File, boolean)` function in the web application security management library ESAPI (OWASP Enterprise Security API) allows a attacker to execute arbitrary code.

The vulnerability of the Validator.getValidDirectoryPathString, String, File, boolean function in the web application security management library ESAPI OWASP Enterprise Security API is related to an incorrect restriction on the path name of a restricted directory. Exploiting this vulnerability...

PT-2022-3468 · Cisco · Cisco Telepresence Video Communication Server +1

Name of the Vulnerable Software and Affected Versions: Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS affected versions not specified Description: The issue is related to multiple vulnerabilities in the API and the web-based management interface of the affected...

The vulnerability of the TrueConf Server software lies in the possibility of bypassing the path in the script /handlers/get-img-file.php, allowing an attacker to access arbitrary files.

The vulnerability of the TrueConf Server software is related to the possibility of bypassing the path in the script /handlers/get-img-file.php. Exploiting this vulnerability allows a malicious actor to gain access to arbitrary files...

The vulnerability of the MSExchangeADTopology service of the Microsoft Exchange Server allows a hacker to increase their privileges.

The vulnerability of the MSExchangeADTopology service of the Microsoft Exchange Server lies in the possibility of bypassing the file path. Exploiting this vulnerability can allow an attacker to enhance their privileges by specifying a file name without quotes...

The vulnerability of the MSExchangeMailboxAssistants service on Microsoft Exchange Server allows attackers to escalate their privileges.

The vulnerability of the MSExchangeMailboxAssistants service in Microsoft Exchange Server lies in the possibility of bypassing the file path. Exploiting this vulnerability can allow an attacker to enhance their privileges by specifying a file path without quotes...

PT-2022-16164 · Wiki.Js · Wiki.Js

Name of the Vulnerable Software and Affected Versions: Wiki.js affected versions not specified Description: The issue affects Wiki.js, a wiki app built on Node.js, where an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths. This is...

CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1...

UBUNTU-CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1...