CVE-2023-2110

CVE-2023-2110 affects Obsidian Desktop prior to 1.2.8 across Windows, Linux and macOS. The issue is improper path handling that allows a crafted webpage to access local files and exfiltrate them to remote servers via app://local/. Exploitation requires user interaction: opening a malicious markdo...

Typora 路径遍历漏洞

Typora is an editor. A path traversal vulnerability exists in Typora version 1.6.7, which stems from an improper path handling vulnerability that affects both Windows and Linux platforms...

PT-2023-22366 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.7.0-dev Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This can be exploited...

PT-2023-18866 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions prior to 1.6.7 Description: The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This can be exploited if a user...

The vulnerability of the iclock interface on the BioTime web-based time tracking platform allows a violator to gain access to read any arbitrary files.

The vulnerability of the iclock interface on the BioTime time tracking management web platform is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain read access to arbitrary files...

The vulnerability of the UploadProgress.ashx component of the system for working with open source Onlyoffice Community Server allows a hacker to execute arbitrary code.

The vulnerability of the UploadProgress.ashx component of the Onlyoffice Community Server system is related to errors in processing the relative path to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-38565

A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges...

CVE-2023-38565

A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges...

CVE-2023-38565

CVE-2023-38565 involves a path handling issue in Apple OS components where insufficient validation could allow a local attacker to gain root privileges. The NVD entry specifies that the underlying problem is a path handling issue that was addressed with improved validation. Affected versions incl...

CVE-2023-38565

A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges...

CVE-2023-38565

A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges...

[SECURITY] [DSA 5460-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5460-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 26, 2023 https://www.debian.org/security/faq -...

PT-2023-4191 · Apple · Libxpc +1

Name of the Vulnerable Software and Affected Versions: libxpc versions prior to macOS Monterey 12.6.8 libxpc versions prior to iOS 16.6 libxpc versions prior to iPadOS 16.6 libxpc versions prior to macOS Big Sur 11.7.9 libxpc versions prior to macOS Ventura 13.5 libxpc versions prior to watchOS 9...

macOS 12.x < 12.6.8 Multiple Vulnerabilities (HT213844)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.8. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS...

OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6,...

The vulnerability of the Copyparty file server arises from errors in processing the relative path to the restricted access directory. This allows a perpetrator to gain read, modify, or delete access to data.

The vulnerability of the Copyparty server is related to errors in processing the relative path to the /.cpr directory http://localhost:3923/.cpr/. This limited access can allow a malicious actor to gain read, modify, or delete privileges...

OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6,...

The vulnerability of the eXchange Layer component in the application development environment for programmable logic controllers ISaGRAF Runtime Rockwell Automation allows a hacker to execute arbitrary code.

The vulnerability of the eXchange Layer component in the application development environment for ISaGRAF Runtime Rockwell Automation relates to errors in processing the relative path to the restricted-access directory. Exploiting this vulnerability may allow a remote attacker to execute arbitrary...

CVE-2023-20884

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure...

CVE-2023-20884

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure...