CVE-2023-49801

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the getpfp and getbanner routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is...

Lif Authentication Server Security Vulnerability

Lif Authentication Server is a Lif Platforms open source server for authenticating Lif account logins, administrative information, and account recovery. A security vulnerability exists in versions of Lif Authentication Server prior to 1.4.0 that stems from a failure to check that files received b...

CVE-2023-48373 ITPison OMICARD EDM 's SMS - Path Traversal

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

CVE-2023-49248

Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access...

CVE-2023-49248

CVE-2023-49248 affects Huawei HarmonyOS, specifically the Settings application. The vulnerability is described as a file override access issue that can lead to unauthorized file access. Connected documents corroborate the issue title and impact but do not provide concrete remediation steps or add...

ASUSTeK COMPUTER RT-AC87U vulnerable to improper access control

Overview RT-AC87U provided by ASUSTeK COMPUTER INC. contains an improper access control vulnerability CWE-284. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact An attacker may read or write files that are not intended to be...

CVE-2023-47678

An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connecting to a target device via tftp...

CVE-2023-47678

An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connecting to a target device via tftp...

Xxe

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a...

PT-2023-9113 · Telit · Telit Cinterion Pls62 +3

Name of the Vulnerable Software and Affected Versions: Telit Cinterion BGS5 Telit Cinterion EHS5/6/8 Telit Cinterion PDS5/6/8 Telit Cinterion ELS61/81 Telit Cinterion PLS62 Description: A Relative Path Traversal issue exists that could allow a local, low privileged attacker to escape from virtual...

The software’s vulnerability in integrating the SpaceLogic system management system with the C-Bus SpaceLogic C-Bus Toolkit allows unauthorized access to files by attackers, due to deficiencies in path name limitation.

The vulnerability of the SpaceLogic system integration software with the C-Bus SpaceLogic C-Bus Toolkit is related to deficiencies in path name limitation. Exploiting this vulnerability can allow an intruder to gain unauthorized access to files...

CVE-2023-40532

Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial information of the files on the web server...

CVE-2023-39407

The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity...

CVE-2023-39407

CVE-2023-39407 is linked to Huawei HarmonyOS with a path traversal vulnerability that can lead to unauthorized information disclosure, affecting confidentiality and integrity. The NVD/CISA-style record notes a high-severity impact (C:H, I:H) with network attack vector and no user interaction. Con...

CVE-2023-39407

The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity...

CVE-2023-39407

The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity...

CVE-2022-45447

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could...

CVE-2023-4480

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write fil...

JVN#92720882: Multiple vulnerabilities in CGIs of PMailServer and PMailServer2

CGIs included with PMailServer and PMailServer2 provided by A.K.I Software contain multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-39223 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVS...

Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH (CVE-2023-40371 and CVE-2023-38408)

Summary Vulnerabilities in AIX's OpenSSH could allow a non-privileged local user file access outside of those allowed CVE-2023-40371 or allow a remote attacker to execute arbitrary code CVE-2023-38408. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2023-40371 DESCRIPTION...