7417 matches found
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
Directory traversal
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
CVE-2017-18586
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
CVE-2019-5634
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy BLE from the mobile application are logged in...
Design/Logic Flaw
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy BLE from the mobile application are logged in...
PT-2019-8520
Name of the Vulnerable Software and Affected Versions insert-pages plugin versions prior to 3.2.4 Description The issue allows for directory traversal through custom template paths. Recommendations For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue...
CVE-2017-18586: Improper Limitation of a Pathname to a Restricted Directory
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...
OpenSSL Default Installation Paths Vulnerability (CVE-2019-1552) - Windows
OpenSSL on Windows is prone to an insecure path defaults vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Kernel: page cache side channel attacks
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...
Kernel: page cache side channel attacks
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...
tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...
Kernel: page cache side channel attacks
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be us...
CVE-2019-14544
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks...
DEBIAN-CVE-2019-10182
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...
UBUNTU-CVE-2019-10182
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user...
PT-2019-5544
Name of the Vulnerable Software and Affected Versions Bundler versions prior to 2.1.0 Description The issue is related to the use of predictable paths in /tmp/ with insecure permissions as a storage location for gems when locations under the user's home directory are not available. If Bundler is...
Pallets Werkzeug Path Traversal Vulnerability
Pallets Werkzeug is a WSGI Web application library. A path traversal vulnerability in Pallets Werkzeug prior to version 0.15.5, which stems from SharedDataMiddleware's failure to correctly handle driver names in Windows path names e.g., C:, can be exploited by an attacker to access arbitrary file...
Openbravo ERP Directory Traversal Vulnerability
Openbravo ERP is a web-based enterprise resource planning ERP solution. A path traversal vulnerability exists in Openbravo ERP versions prior to 3.0PR19Q1.3. The vulnerability stems from the failure of a networked system or product to properly filter special elements in the path of a resource or...
DEBIAN-CVE-2019-11730
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and...
Code injection
ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to...