The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to gain access to confidential information.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

PT-2023-29857

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides web application is vulnerable to a Server-Side Request Forgery SSRF attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing...

8x8: Unprotected Atlantis Server at https://152.70.█.█

The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...

The vulnerability of the Suricata intrusion detection and prevention system arises from an improper limitation on the path name to the restricted access catalog. This allows intruders to write arbitrary files into the file system.

The vulnerability of the Suricata intrusion detection and prevention system lies in the incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files into the file system...

PT-2023-6017 · Fortinet · Fortiwlm

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue is related to insufficient checking of arguments passed to a command, allowing a remote attacker to execute arbitrary code...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to delete any files they desire.

The vulnerability of the command-line interface of ArubaOS systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor to delete any files remotely...

PT-2023-7696 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.10 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. This vulnerability can be exploited by an attacker to bypass mitigations...

PT-2023-28981 · Cadence · Cadence

Name of the Vulnerable Software and Affected Versions: Cadence versions through 0.9.2 2023-08-21 Description: The issue arises from Cadence using an insecure temporary file /tmp/cadence-wineasio.reg. If a local adversary creates this file before Cadence starts, Cadence will use it, allowing the...

PT-2023-28177 · Jenkins · Jenkins Ssh2 Easy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SSH2 Easy Plugin versions 1.4 and earlier Description: The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage...

PT-2023-23735 · Ibm · Ibm Sterling Secure Proxy +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy and IBM Sterling External Authentication Server versions 6.0.3 through 6.1.0 Description: The issue allows a local user with container access to read user credentials stored in plain clear text. Recommendations: For...

PT-2023-30323 · Unknown · Xintian Smart Table Integrated Management System

Name of the Vulnerable Software and Affected Versions: Xintian Smart Table Integrated Management System version 5.6.9 Description: A critical issue was found in the Xintian Smart Table Integrated Management System. This issue affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The...

PT-2023-27663 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue concerns a command execution vulnerability in the sub ADD50 function. This vulnerability is exploited when the formSetIptv function obtains the list and vlanId...

PT-2023-29577 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Inventory Management System. The issue affects an unknown function of the file app/ajax/search purchase paymen...

PT-2023-27099 · Unknown · Lrzip-Next

Name of the Vulnerable Software and Affected Versions: lrzip-next LZMA version 23.01 Description: The issue is related to an access violation in the component /bz3 decode block, located in the src/libbz3.c file. This access violation can be exploited, potentially leading to unintended consequence...

PT-2023-27136 · Doctormms · Doctormms

Name of the Vulnerable Software and Affected Versions: Doctormms version 1.0 Description: A SQL injection vulnerability was discovered in Doctormms via the userid parameter at the "myAppoinment.php" endpoint. This issue is disputed by a third party, who claims that the userid is a session variabl...

PT-2023-7521 · Sierra Wireless · Aleos

Name of the Vulnerable Software and Affected Versions: ALEOS versions 4.16 and earlier Description: The issue is related to the use of hardcoded credentials in the debugging mode of the ALEOS operating system for Sierra Wireless MP70, RV50x, RV55, LX40, LX60 ES450, GX450 wireless routers. When...

PT-2023-11772 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.2.1 Description: The issue allows remote attackers to execute arbitrary code and gain sensitive information via a crafted payload in the Add New Deposit field in the View All Deposit module. This is a Cross Site Scripting...

PT-2023-19359 · Wpazure Themes · Wpazure Themes Upfrontwp

Name of the Vulnerable Software and Affected Versions: Wpazure Themes Upfrontwp theme versions = 1.1 Description: The issue is related to an Authenticated Reflected Cross-site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, whi...

SecurityCouncilMemberElectionGovernor propose() function is not properly restricted

Lines of code Vulnerability details summary The propose function in the SecurityCouncilMemberElectionGovernor contract is not properly restricted. This means that any user can call it, including attackers. Description The propose function in the SecurityCouncilMemberElectionGovernor contract is...

PT-2023-4690 · Unknown · Sicam Toolbox Ii

Name of the Vulnerable Software and Affected Versions: SICAM TOOLBOX II versions prior to V07.10 Description: A vulnerability has been identified in the SICAM TOOLBOX II application, where the database service is executed as NT AUTHORITYSYSTEM. This could allow a local attacker to execute operati...