1728 matches found
python: Path traversal on tempfile.TemporaryDirectory
A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...
PT-2024-22600 · Checkmk · Checkmk
Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p7 Checkmk versions prior to 2.2.0p28 Checkmk versions prior to 2.1.0p45 Checkmk version 2.0.0 Description: The issue allows users with permission to change Global Settings to execute arbitrary scripts by...
python: Path traversal on tempfile.TemporaryDirectory
A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...
CVE-2023-3352 Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the deleteresmushlist function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen ...
CVE-2022-41324
Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information...
CVE-2022-41324
Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information...
Privilege Escalation
github.com/dnscrypt/dnscrypt-proxy is vulnerable to Privilege escalation. The vulnerability is caused by insecure file permissions on the dnscrypt-proxy executable, which allows non-privileged users to overwrite it with malicious code, leading to potential privilege escalation to root when the...
UBUNTU-CVE-2024-36587
Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy...
WordPress plugin Floating Chat Widget security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-4924
The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-29848
An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...
Ivanti Neurons Security Breach
Ivanti Neurons is a groundbreaking platform from US-based Ivanti that simplifies and automates IT systems. A security vulnerability exists in Ivanti Neurons for ITSM that stems from an unrestricted file upload vulnerability in the Web component that allows remote, authenticated, and highly...
PT-2024-36493 · Alkacon · Opencms
Name of the Vulnerable Software and Affected Versions: Alkacon's OpenCMS version 16 Description: Two Cross-Site Scripting issues have been discovered in Alkacon's OpenCMS, which could allow a user with sufficient privileges to create and modify web pages through the admin panel to execute malicio...
python: Path traversal on tempfile.TemporaryDirectory
A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...
CVE-2024-29852
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...
CVE-2024-29852
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...
CVE-2024-29852
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...
PT-2024-23085
Name of the Vulnerable Software and Affected Versions Veeam Backup Enterprise Manager affected versions not specified Description The issue allows high-privileged users to read backup session logs. There is no information provided about the estimated number of potentially affected devices worldwi...