PT-2020-1466

Name of the Vulnerable Software and Affected Versions Java SE versions 7u241, 8u231, 11.0.5, and 13.0.1 Java SE Embedded version 8u231 Description The issue is related to the Networking component and can be exploited by an unauthenticated attacker with network access via multiple protocols,...

WordPress Prior to 5.3.1 Multiple Security Vulnerabilities

Description WordPress is prone to multiple security vulnerabilities. An attacker may leverage these issues to bypass certain security restrictions and perform unauthorized actions or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

PT-2019-15863 · Intelbras · Intelbras Wrn 150

Name of the Vulnerable Software and Affected Versions: Intelbras WRN 150 version 1.0.18 Description: The issue allows for cross-site request forgery CSRF attacks, which can be used to change a password. This can be achieved by accessing the goform/SysToolChangePwd URI with GO=system password.asp...

CVE-2019-12523

An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers,...

PT-2019-4192 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.x.x and 4.x.x before 4.18.0 Description: The issue is related to a heap overflow flaw in the Marvell WiFi chip driver of the Linux kernel. This flaw allows a remote attacker to cause a system crash, resulting in a deni...

The vulnerability of the Ruby interpreter’s methods Dir.open, Dir.new, Dir.entries, and Dir.empty allows attackers to gain unauthorized access to protected data or compromise the integrity of protected information.

The vulnerability of the Dir.open, Dir.new, Dir.entries, and Dir.empty methods in the Ruby programming language exists due to incorrect path name restrictions for restricted-access directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected data or...

The vulnerability of the readMetadata function in the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the readMetadata function in the Utils.cpp file of the Android operating system exists due to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability can allow a malicious individual to enhance their privileges when connecti...

PT-2019-5216 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a Server Side Request Forgery SSRF vulnerability. This occurs because URL validation does not consider the interpretation of a name as a series of hex characters...

PT-2019-3196 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue is related to a driver vulnerability in the ws2ifsl.sys Winsock component of the Windows operating system, which is associated with errors in processing objects in...

The vulnerability of the McAfee Enterprise Security Manager system arises from an incorrect restriction on the path to the restricted directory. This allows attackers to elevate their privileges.

The vulnerability of the McAfee Enterprise Security Manager critical threat detection system exists due to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

PT-2019-18486 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series versions le1.00-06 Description: The issue allows Command Injections. Linear eMerge E3-Series devices are affected. The vulnerability was exploited in the wild, posing significant security risks. Recommendations: For...

The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent exists due to errors in path name restrictions for restricted access directories. This allows attackers to disclose protected information.

The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent exists due to errors in path name restrictions for restricted access directories. Exploiting this vulnerability could allow a attacker to disclose protected information...

PT-2019-2063 · Cisco · Cisco Ftd

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense Software affected versions not specified Description: The issue exists due to insufficient input validation in the command-line interface of the software, allowing an attacker to perform a command injection...

PT-2019-1930 · Mysql Server +5 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.15 and prior Description: The issue is related to insufficient access control in the MySQL Server component, specifically in the Replication subcomponent. This can be exploited by a remote attacker to cause a denial ...

CVE-2018-4380

CVE-2018-4380 describes a lock-screen information disclosure in iOS prior to 12.0.1, where a local attacker could view photos and contacts from the lock screen. The issue was addressed in iOS 12.0.1 by restricting options offered on a locked device. Affected versions: prior to iOS 12.0.1. Exploit...

UBUNTU-CVE-2019-3810

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its acces...

Digi TransPort LR54 Restricted Shell Escape

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2018-20162: Digi TransPort LR54 Restricted Shell Escape =========================================================== The Digi TransPort LR54 is a high speed LTE router commonly used by industry, infrastructure, retail and public transportation. I...

The vulnerability of the reposync function of the YUM package manager, which allows a hacker to create, modify, or delete any files they desire.

The vulnerability of the reposync function in the YUM package manager exists due to insufficient restrictions on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to create, modify, or delete any files as desired from a remote location...

The vulnerability of the IIoT Monitor platform, related to the lack of special character filtering, allows attackers to access areas beyond the restricted catalog.

The vulnerability of the IIoT Monitor platform lies in the lack of filtering for specific symbols. Exploiting this vulnerability could allow a malicious actor to access data beyond the limited access scope of the catalog...

PT-2018-3070 · Audiocoding +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.8.8 Description: The issue is related to a stack-based buffer underflow in the calculate gain function. A crafted input can lead to a denial of service or possibly other impacts due to the...