The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming software for the Totolink T8 router, allows a hacker to disclose protected information.

The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming system for the Totolink T8 router, is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

PYSEC-2024-4

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...

CVE-2023-6631

CVE-2023-6631 affects Subnet Solutions PowerSYSTEM Center (PowerSYSTEM Center 2020 Update 16 and earlier; 5.0.x–5.16.x). The vulnerability is an unquoted search path/element in the service path that authorized local users can abuse to insert arbitrary code and achieve privilege escalation. Affect...

africa.absa:inception-test (>=1.0.0 <=1.2.0), ai.apiverse:apipulse (=1.0.1) +9501 more potentially affected by CVE-2023-51074 via com.jayway.jsonpath:json-path (>=2.2.0 <=2.8.0)

com.jayway.jsonpath:json-path MAVEN version =2.2.0, =1.0.0, =0.0.2, =0.0.2, =0.0.10, =0.0.6, =1.1.0, =1.6.8, =4.1.0, =4.0.0, =3.4.0, =3.5.4-rc.0, =2.0, =2.0, =3.0 and more Source cves: CVE-2023-51074 Source advisory: OSV:GHSA-PFH2-HFMQ-PHG5...

Stack overflow

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method...

CVE-2023-49406

Tenda W30E V16.01.0.124843 was discovered to contain a Command Execution vulnerability via the function /goform/telnet...

CVE-2023-4931

Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll,...

XXL-JOB Security Vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xue Li XXL-JOB community. A security vulnerability exists in XXL-JOB xxl-job-admin version 2.4.0, which originates from a mismanagement of privileges vulnerability in the paths xxl-job-admin/joblog/clearLog a...

CVE-2023-25075

Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-41840

A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path...

CVE-2023-4632

An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges...

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system...

PT-2023-12753 · WordPress · Imagemagick Engine

Name of the Vulnerable Software and Affected Versions: ImageMagick Engine plugin for WordPress versions up to, and including 1.7.5 Description: The issue allows for remote code execution via the cli path parameter. This enables unauthenticated users to run arbitrary commands, potentially leading ...

Design/Logic Flaw

Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass.This issue affects Digital Yepas: before 1.0.1...

The vulnerability of the Node.js software platform installation process (.msi version) allows a perpetrator to escalate their privileges within the system.

The vulnerability of the Node.js software platform’s installation process version .msi is related to the use of an unreliable search path. Exploiting this vulnerability allows a malicious actor to escalate their privileges within the system...

CVE-2023-41105

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath, the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python...

Design/Logic Flaw

Adobe Acrobat Reader versions 23.003.20244 and earlier and 20.005.30467 and earlier are affected by an Untrusted Search Path vulnerability that could lead to Application denial-of-service. An attacker could leverage this vulnerability if the default PowerShell Set-ExecutionPolicy is set to...

Social-Commerce 3.1.6 Cross Site Scripting

Exploit Title: Social-Commerce 3.1.6 - Reflected XSS Exploit Author: CraCkEr Date: 28/07/2023 Vendor: mooSocial Vendor Homepage: https://moosocial.com/ Software Link: https://social-commerce.moosocial.com/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE: CVE-2023-4174...

CVE-2023-38695

cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in...

Design/Logic Flaw

cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in...