1322 matches found
CVE-2023-40383
A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data...
CVE-2023-40383
A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data...
CVE-2023-40383
A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data...
CVE-2023-40383: Improper Limitation of a Pathname to a Restricted Directory
A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data...
Medium: golang
Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...
Cacti security breach
Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to obtain data , using RRDtool drawing graphs to analyze , and provide data and user management features . A security vulnerability exists in Cacti versions prior to 1.2.26,...
PT-2023-8256 · Nvidia · Nvidia Triton Inference Server
Name of the Vulnerable Software and Affected Versions: NVIDIA Triton Inference Server affected versions not specified Description: The issue is related to errors in processing relative paths to directories during model loading in NVIDIA Triton Inference Server. This can allow a remote attacker to...
CVE-2023-6559
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary...
PT-2023-7804 · Asterisk +3 · Asterisk +3
Name of the Vulnerable Software and Affected Versions: Asterisk versions prior to 18.20.1, 20.5.1, and 21.0.1 certified-asterisk versions prior to 18.9-cert6 Description: The issue is related to the Asterisk Management Interface AMI and is caused by incorrect restriction of the directory path nam...
Apache Struts Code Execution
The vulnerability of the Apache Struts software platform is related to the use of files and directories accessible from external parties due to incorrect restrictions on the path to the restricted directory during file loading. Exploiting this vulnerability allows a remote attacker to execute...
PT-2023-28651
Name of the Vulnerable Software and Affected Versions macOS Monterey versions prior to 12.7.2 macOS Ventura versions prior to 13.6.3 iOS versions prior to 17.2 iPadOS versions prior to 17.2 tvOS versions prior to 17.2 watchOS versions prior to 10.2 macOS Sonoma versions prior to 14.2 Description ...
CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling
Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server richdocumentscode is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attac...
OESA-2023-1886 haproxy security update
HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: An information lea...
Fortinet FortiWLM Path Traversal
The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows an attacker, operating remotely, to read arbitrary files using specially creat...
AZL-98664 CVE-2023-45283 affecting package golang 1.27.1-1
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...
CVE-2023-45283
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...
kernel: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pcigetdevwrapper As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, so it doesn't need to call an extra pcidevget in pcigetdevwrapper, and the PCI...
ShowTechDownloadView Class ACOS Unauthorized Access
The vulnerability of the ShowTechDownloadView class in the Advanced Core Operating System ACOS controller A10 Thunder ADC is related to an incorrect path name limitation for access to restricted directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...
PT-2024-13071 · Apple · Ios +2
Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 17 Apple iPadOS versions prior to 17 Apple macOS versions prior to Sonoma 14 Description: A path handling issue was addressed with improved validation, which may allow an app to break out of its sandbox...
TinyMCE Moodle Data Access
The vulnerability of the TinyMCE plugin in the virtual training environment Moodle is related to incorrect external management of file names or file paths during data loading. Exploiting this vulnerability can allow an attacker to gain access to, read, modify, or delete data by sending specially...