CVE-2023-36664-Ghostscript-command-injection

ثغرة حقن الأوامر في Ghostscript CVE-2023-36664 - إثبات المفهوم تم الكشف عن ثغرة في Ghostscript قبل الإصدار 10.01.2 تؤدي إلى تنفيذ الأوامر درجة CVSS 9.8. الوصف الرسمي للثغرة: يتعامل Artifex Ghostscript حتى الإصدار 10.01.2 بشكل خاطئ مع التحقق من صلاحيات أجهزة الأنابيب بالبادئة %pipe% أو حرف الأنبوب...

CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC CVE-2023-36664 Vulnerability disclosed in Ghostscript prior to version 10.01.2 leads to code execution CVSS score 9.8. Official vulnerability description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the...

Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2024_3835)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243835 advisory. libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution CVE-2023-6185 libreoffice: Insufficient macro permission validation...

AlmaLinux 9.2 [TuxCare] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc (ALMALINUX9.2:CLSA-2025:1745596088)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745596088 advisory. - Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without...

CVE-2026-101006

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

EUVD-2026-88097

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

CVE-2026-101006 Frappe HR Permission Validation __init__.py get_attendance_requests authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

CVE-2026-101006 Frappe HR Permission Validation __init__.py get_attendance_requests authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

PT-2026-99771

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.15.0 Description An incorrect authorization issue exists within the Permission Validation component. The flaw allows remote exploitation by manipulating the employee argument in the get expense claims, get shift...

CVE-2026-101006: Incorrect Authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

Unity Linux 20.1070e Security Update: ghostscript (UTSA-2023-004048)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-004048 advisory. Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix. Tenable has extracted th...

PT-2026-94060

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.11.1 Description Insufficient validation of caller permissions in the 'DELETE /api/v2/rbac/id' endpoint allows users with read access to delete access control relationships. This can enable attackers to revoke the...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

EUVD-2026-78314

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-91778

CVE-2026-91778 affects Octopus Server and stems from incorrect permission validation during script execution. Users holding certain scoped permission sets can execute arbitrary scripts on a worker—including the Octopus Server built-in worker—without possessing the required authorization. This is ...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-91778

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-91778: Incorrect Authorization

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...

CVE-2026-86836

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes FIFOs under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Permissions for inline model instances were not validated when submitting forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...