7367 matches found
CVE-2024-23339
Hoolock versions 2.0.0–2.2.0 expose a Prototype Pollution risk via object-path utilities (get, set, update) that fail to block inherited property access/modification. Starting in 2.2.1 these functions throw a TypeError when attempting to access or alter inherited properties, mitigating the vulner...
CVE-2020-36772
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...
CVE-2020-36772
CloudLinux CageFS CVE-2020-36772 affects CageFS 7.0.8-2 and earlier, where file paths given to the sendmail proxy command are not sufficiently restricted. This enables local users to read/write arbitrary files outside the CageFS environment. The vulnerability is triggered by insufficient path val...
CVE-2024-23331
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
Design/Logic Flaw
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
CVE-2023-48249
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...
CVE-2023-48246
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...
CVE-2023-48246
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...
CVE-2023-48243
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution RCE with root privileges on the device...
CVE-2023-48242
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...
Cross site request forgery (csrf)
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...
Design/Logic Flaw
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...
Remote code execution
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution RCE with root privileges on the device...
CVE-2023-48246
CVE-2023-48246 affects Bosch Nexo/Nexo-OS devices. A crafted HTTP request can trigger downloading arbitrary files from all system paths under the application’s OS user context (root). Documented impact is file disclosure with root privileges; no exploitation details or likelihood provided. Public...
CVE-2023-48243
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution RCE with root privileges on the device...
Amazon Linux 2 : golang (ALAS-2024-2388)
The version of golang installed on the remote host is prior to 1.20.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2388 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many...
PT-2024-2793 · Dell · Dell Unity
Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.4 Description: The issue is related to a path traversal vulnerability in the svc supportassist utility of Dell Unity. An authenticated attacker could potentially exploit this vulnerability to gain unauthorized...
WordPress Plugin Clone Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
HCL Technologies DRYiCE MyXalytics Path Traversal Vulnerability
HCL Technologies DRYiCE MyXalytics is a unified reporting and dashboard product from HCL Technologies, USA. A security vulnerability exists in HCL Technologies DRYiCE MyXalytics that stems from certain endpoints that allow a user to manipulate the path including filename where these files are...