PT-2024-11538 · Mautic · Mautic

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 Description: Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could...

Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

PT-2024-25726 · Sourcecodester · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A critical issue has been found in the processing of the file admin/saveeditt.php, where the manipulation of the contact argument leads to sql injection. The attack can be initiated...

Archiver Path Traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...

CVE-2024-0406

CVE-2024-0406 concerns the mholt/archiver package. The connected Nessus/SUSE entries confirm a path-traversal flaw in tar unpacking that can cause writing to restricted files or directories when extracting archives. The remediation path shown in the connected docs includes upgrading the affected ...

CVE-2024-0406 Mholt/archiver: path traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...

The vulnerability of the pgAdmin 4 database management tool arises from an incorrect path name limitation for the restricted access directory, allowing a hacker to execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool exists due to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-25137 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A critical issue has been found in the SourceCodester Computer Laboratory Management System, affecting an unknown functionality of the file /admin/category/view...

PT-2024-22574 · Ibm · Ibm Application Gateway +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.7 IBM Application Gateway versions 20.01 through 24.03 Description: The issue allows a remote attacker to obtain highly sensitive private information or cause a denial of service using a...

PT-2024-13169 · Veridium · Veridiumid

Name of the Vulnerable Software and Affected Versions: VeridiumID versions prior to 3.5.0 Description: The issue concerns a cross-site scripting XSS vulnerability in the identity provider page. This vulnerability can be exploited by an internal unauthenticated attacker to execute JavaScript in th...

PT-2024-21936 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.2.7 Concrete CMS versions prior to 8.5.16 Description: The issue concerns a Stored XSS vulnerability on the calendar color settings screen. This occurs because user input is output without proper escaping...

Tuleap 安全漏洞

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A vulnerability exists in Tuleap Community Edition versions prior to 15.7.99.6, Tuleap Enterprise Edition...

PT-2024-23514 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: The issue is a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. Recommendations: For Tenda FH1203 version 2.0.1.6, as a temporary workaround, consider restricti...

The vulnerability of the AutomationDirect C-MORE EA9 HMI software-related to incorrect restrictions on path names in the restricted access catalog allows a intruder to trigger a service failure.

The vulnerability of the Microprogrammed Control Panel Software of AutomationDirect C-MORE EA9 HMI is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker to trigger a service failure...

The vulnerability of Microprogrammed Software in Sharp, NEC’s P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 displays due to a incorrect restriction on the path name to the restricted access catalog. This allows an attacker to execute arbitrary code.

The vulnerability of Microprogrammed Software in Sharp, NEC’s P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, and MD551C8 displays due to an incorrect...

The vulnerability of the microprogramming software for UniLogic Studio series UniStream-controlled programmable logic controllers arises from incorrect restrictions on the path name to the restricted-access directory. This allows attackers to execute arbitrary code.

The vulnerability of the microprogramming software for UniLogic Studio programmable logic controllers of the UniStream series is related to an incorrect restriction on the path name of the restricted access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrar...

PT-2024-21309 · Fujian Kelixin · Fujian Kelixin Communication Command/Dispatch Platform

Name of the Vulnerable Software and Affected Versions: Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 Description: A critical issue has been found, affecting an unknown part of the file /api/client/editemedia.php. The manipulation of the enterprise uuid argument leads t...

PT-2024-18092 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.30 Description: The issue is related to Stored Cross-Site Scripting via the form widget addr2 width attribute due to insufficient input sanitization and outpu...

PT-2024-2412 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this by convincing a victim to visit a specially crafted URL, potentially...

BIT-ETCD-2020-15113 Improper Preservation of Permissions in etcd

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...