The vulnerability of Siemens’ TIA portal software allows a violator to enhance their privileges.

The vulnerability of Siemens TIA portal’s automation control software is related to an incorrect restriction on the path name to the restricted access catalog “Path bypass”. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2020-10979

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

CVE-2020-10979

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

CVE-2020-10979

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users...

PT-2020-12464 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 11.10 through 12.9 Description: The issue is related to the leaking of information on restricted CI pipelines metrics to unauthorized users. Recommendations: For GitLab EE/CE versions 11.10 through 12.9, update to a...

CVE-2020-6974

Honeywell Notifier Web Server NWS Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem...

PT-2020-15383 · Jenkins · Jenkins Gatling Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gatling Plugin versions 1.2.7 and earlier Description: The issue results in a cross-site scripting XSS vulnerability, which is exploitable by users able to change report content. This occurs because the plugin prevents...

PT-2020-14898 · Red Hat +1 · Pki-Core +1

Name of the Vulnerable Software and Affected Versions: pki-core versions 10.x.x Description: A flaw was found in the Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker wi...

Design/Logic Flaw

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types which may contain sensitive information as well as function names...

PT-2020-15336 · Jenkins · Jenkins Bmc Release Package/Deployment Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins BMC Release Package and Deployment Plugin versions 1.1 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file on the Jenkins master. This can be viewed by users with access to t...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and the Microsoft SharePoint Foundation software for electronic document management exists due to a faulty limitation on the path name to the restricted access catalog. This allows attackers to exploit the protected resources.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and the Microsoft SharePoint Foundation software exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor to disclose...

PT-2020-1466

Name of the Vulnerable Software and Affected Versions Java SE versions 7u241, 8u231, 11.0.5, and 13.0.1 Java SE Embedded version 8u231 Description The issue is related to the Networking component and can be exploited by an unauthenticated attacker with network access via multiple protocols,...

WordPress Prior to 5.3.1 Multiple Security Vulnerabilities

Description WordPress is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions and perform unauthorized actions or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

PT-2019-15863 · Intelbras · Intelbras Wrn 150

Name of the Vulnerable Software and Affected Versions: Intelbras WRN 150 version 1.0.18 Description: The issue allows for cross-site request forgery CSRF attacks, which can be used to change a password. This can be achieved by accessing the goform/SysToolChangePwd URI with GO=system password.asp...

CVE-2019-12523

An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers,...

PT-2019-4192 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.x.x and 4.x.x before 4.18.0 Description: The issue is related to a heap overflow flaw in the Marvell WiFi chip driver of the Linux kernel. This flaw allows a remote attacker to cause a system crash, resulting in a deni...

The vulnerability of the Ruby interpreter’s methods Dir.open, Dir.new, Dir.entries, and Dir.empty allows attackers to gain unauthorized access to protected data or compromise the integrity of protected information.

The vulnerability of the Dir.open, Dir.new, Dir.entries, and Dir.empty methods in the Ruby programming language exists due to incorrect path name restrictions for restricted-access directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or...

The vulnerability of the readMetadata function in the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the readMetadata function in the Utils.cpp file of the Android operating system exists due to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability can allow a malicious individual to enhance their privileges when connecti...

PT-2019-5216 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a Server Side Request Forgery SSRF vulnerability. This occurs because URL validation does not consider the interpretation of a name as a series of hex characters...

PT-2019-3196 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to a driver vulnerability in the ws2ifsl.sys Winsock component of the Windows operating system, which is associated with errors in processing objects in...