ZKTeco BioAccess IVS Path Traversal Vulnerability

ZKTeco BioAccess IVS is a lite web-based security platform from ZKTeco, China. A path traversal vulnerability exists in ZKTeco BioAccess IVS v3.3.1, which stems from the program's failure to properly filter special elements in the path of a resource or file, and can be exploited by an attacker to...

CVE-2023-37627

Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc...

CVE-2023-38065

CVE-2023-38065 concerns JetBrains TeamCity before 2023.05.1, where a stored XSS vulnerability exists when viewing the build log. Sources (CNVD, Red Hat, Nessus and others) describe the issue as caused by incorrect validation of user-supplied input in the build log and confirm the vulnerability is...

ManageEngine ADManager Plus < Build 7183 XXE

Zoho ManageEngine ADManager Plus before version 7.1 Build 7183 allows authenticated administrators to perform XML external entity injection XXE attacks and view files in servers. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Milesight UR32L 路径遍历漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L suffers from a directory traversal vulnerability that can be exploited by an attacker to view arbitrary files on the system by sending a specially crafted URL request containing a "dot dot" sequence /.../. /...

Code injection

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...

Siemens Teamcenter Visualization and JT2Go Memory Corruption Vulnerability

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML with available JT, VFZ, CGM and TIF data.Teamcenter Visualization software is able to enhance its Product Lifecycle Management PLM environments with a comprehensive range of visualization solutions. PLM environme...

CVE-2023-31437

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."...

Duplicate Advisory: Starlette vulnerable to directory traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v5gw-mw7f-84px. This link is maintained to preserve external references. Original Description Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote...

PYSEC-2023-83

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...

CVE-2023-29159

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette...

CVE-2023-31677

Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter...

Jenkins Plugin Email Extension 跨站请求伪造漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins Plugin Email Extension. An attacker could exploit the vulnerability to allow...

Cross site scripting

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation...

Rockwell Automation ArmorStart ST 跨站脚本漏洞

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. A cross-site scripting vulnerability exists in Rockwell Automation ArmorStart ST, which can be exploited by an attacker to view and modify sensitive data or...

Amazon Linux AMI : tomcat7 (ALAS-2023-1738)

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1738 advisory. 2023-05-11: CVE-2017-12616 was added to this advisory. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0....

Oracle Primavera P6 Enterprise Project Portfolio Management (April 2023 CPU)

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by a buffer overflow vulnerability as referenced in the April 2023 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction...

CVE-2023-29517

CVE-2023-29517 affects XWiki Platform, where the office document viewer macro could disclose any file on the host and trigger internal requests, depending on the servlet user’s permissions. Root cause: insecure access via the office viewer macro enabling information disclosure. Affected versions ...

CVE-2023-29208

XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on...