Directory traversal

When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions disregarding Axeda agent v6.9.2 and v6.9.3 is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server...

CVE-2022-25247

CVE-2022-25247 affects PTC Axeda agent and Axeda Desktop Server for Windows (all versions). The flaw is missing authentication for a critical function that lets a remote unauthenticated attacker send commands to a specific port, potentially enabling remote code execution and full filesystem acces...

CVE-2022-25247 PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Axeda agent All versions and Axeda Desktop Server for Windows All versions may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and...

CVE-2022-25247 PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function

Axeda agent All versions and Axeda Desktop Server for Windows All versions may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and...

CVE-2022-27217

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-27218

CVE-2022-27218 affects Jenkins incapptic connect uploader Plugin 1.15 and earlier. The connected Red Hat/NVD/OSV/GHSA entries confirm that tokens are stored unencrypted in job config.xml files on the Jenkins controller and can be viewed by users with Extended Read permission or with access to the...

CVE-2022-27217

CVE-2022-27217 affects Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier. The vulnerability is an information disclosure where passwords are stored unencrypted in job config.xml on the Jenkins controller and can be viewed by users with Extended Read permission or with access to the contro...

PT-2022-18304 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: The issue concerns the storage of JDBC connection passwords in the global configuration file on the Jenkins controller. These passwords are stored unencrypted and can be viewed b...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

Directory Traversal

Rust is vulnerable to directory traversal. The vulnerability exists due to a race condition which allows an attacker to access the file system of the application...

Heimdal Premium Security 安全漏洞

Heimdal Premium Security is an antivirus security software from the Danish company Heimdal. A security vulnerability exists in Heimdal Premium Security 2.5.395 and earlier versions, which stems from an insecure privilege setting in the Heimdal.Wizard.exe installer. The vulnerability can be...

otris Update Manager 授权问题漏洞

otris Update Manager is used by otris for compliance digitization. A security vulnerability exists in otris Update Manager 1.2.1.0 that allows local users to gain access to SYSTEM via unauthenticated calls and allows remote attacks on HTTP traffic on TCP port 9000 using WsHTTPBinding...

CVE-2021-40376

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000...

CVE-2021-40376

CVE-2021-40376 affects otris Update Manager 1.2.1.0. The vulnerability allows local users to obtain SYSTEM privileges by sending unauthenticated calls to exposed interfaces via a .NET named pipe. A remote attack may be possible by abusing WsHTTPBinding for HTTP traffic on TCP port 9000. CVSS data...

CVE-2021-32008 Logged-in Administrator may get unrestricted file system access

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...

Denial Of Service (DoS)

com.liferay.layout.admin.web is vulnerable to denial of service. The vulnerability exists due to improper handle of user privileges in script.jsp file allows a remote attacker to restrict system access to the legitimate users...

CVE-2022-25623

The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations...

PT-2022-17416 · Symantec · Symantec Management Agent

Name of the Vulnerable Software and Affected Versions: Symantec Management Agent affected versions not specified Description: The Symantec Management Agent is susceptible to a privilege escalation issue. A low privilege local account can be elevated to the SYSTEM level through registry...