PT-2024-17346 · South River · South River Webdrive

Name of the Vulnerable Software and Affected Versions: South River WebDrive version 18.00.5057 Description: A vulnerability was found in the New Secure WebDAV component, which can lead to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the...

spanishriverinn.com Cross Site Scripting vulnerability OBB-3847188

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Logic Flaw Vulnerability in the Integrated Management System of River Management System of Sichuang Technology Co.

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A logic flaw vulnerability exists in the integrated river management system of Sicron Technology Limited, which can be exploited by an attacker to bypass system authentication and login...

Mitsubishi Electric MELSEC-Q Series C Controller Module Denial of Service and Malicious Code Execution (CVE-2021-29998)

Denial of Service and Malicious Code Execution Vulnerability exists in DHCP client function of VxWorks version 6.4, a real-time OS distributed by Wind River. A remote attacker may cause a denial of service DoS condition or execute malicious code on a target product by sending specially crafted...

Siemens SIPROTEC 4 7SJ66

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Sophisticated MATA Framework Strikes Eastern European Oil and Gas Companies

An updated version of a sophisticated backdoor framework called MATA has been used in attacks aimed at over a dozen Eastern European companies in the oil and gas sector and defense industry as part of a cyber espionage operation that took place between August 2022 and May 2023. "The actors behind...

CVE-2023-45686

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45690

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

Path traversal

Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

Session fixation

A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing...

Path traversal

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

Default credentials

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690

CVE-2023-45690 is part of a set of post-authentication issues in South River Technologies’ Titan MFT/SFTP servers (Linux) that were disclosed by multiple sources. Connected documents show concrete details: (1) 45690 describes an information leak via a world-readable database and logs, enabling an...

CVE-2023-45689 Arbitrary file read via path traversal in Titan MFT and Titan SFTP servers

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal...

CVE-2023-45689

CVE-2023-45689 is a path traversal information-disclosure flaw in South River Technologies’ Titan MFT and Titan SFTP servers running on Windows and Linux. The root cause is insufficient path validation in the admin interface, enabling an authenticated user with administrative privileges to read a...

CVE-2023-45689 Arbitrary file read via path traversal in Titan MFT and Titan SFTP servers

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal...

CVE-2023-45688 Information leak via path traversal in Titan MFT and Titan SFTP servers

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command...

CVE-2023-45688 Information leak via path traversal in Titan MFT and Titan SFTP servers

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command...

CVE-2023-45687

CVE-2023-45687 affects South River Technologies’ Titan MFT and Titan SFTP servers (Linux/Windows). The issue is a session fixation vulnerability where an attacker can bypass authentication by tricking an administrator into authorizing a session id of the attacker’s choosing. Public sources descri...