Permission Design Vulnerability in Chocolatey Ruby

Chocolatey is a NuGet-based package manager developed for Windows systems.Ruby is a cross-platform, object-oriented, dynamically-typed programming language developed by the individual developer Yukihiro Matsumoto. A privilege design vulnerability exists in the Chocolatey Ruby package v3.1.2.1 and...

Chocolatey Cmder has an unspecified vulnerability

Chocolatey Cmder is a package open sourced by Chocolatey. Chocolatey Cmder v1.3.20 and earlier versions contain a security vulnerability. An attacker could gain write access to the path C:\tools\Cmder and all files located in that folder for all users in the Authenticated Users group...

CVE-2022-45306

Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder...

CVE-2022-45304

Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder...

Chocolatey Cmder 安全漏洞

Chocolatey Cmder is a package open sourced by Chocolatey. Chocolatey Cmder v1.3.20 and earlier versions contain a security vulnerability. An attacker could gain write access to the path C:\tools\Cmder and all files located in that folder for all users in the Authenticated Users group...

PHP 安全漏洞

PHP is a scripting language that executes on the server side. A privilege design vulnerability exists in the Chocolatey PHP package v8.1.12 and below, which originates from all users in the Authenticated users group having write access to the subfolder C:\tools\php81 and all files in that folder,...

PT-2022-27463 · Chocolatey · Chocolatey Python3

Name of the Vulnerable Software and Affected Versions: Chocolatey Python3 package versions 3.11.0 and below Description: The issue is related to insecure permissions in the Chocolatey Python3 package, which grants all users in the Authenticated Users group write privileges for the subfolder...

PT-2022-27461 · Chocolatey · Chocolatey Ruby Package

Name of the Vulnerable Software and Affected Versions: Chocolatey Ruby package versions 3.1.2.1 and below Description: The issue is related to insecure permissions in the Chocolatey Ruby package, which grants all users in the Authenticated Users group write privileges for the path C:toolsruby31 a...

PT-2022-27464 · Microsoft · Chocolatey Azure-Pipelines-Agent

Name of the Vulnerable Software and Affected Versions: Chocolatey Azure-Pipelines-Agent versions 2.211.1 and below Description: The issue is related to insecure permissions in the Chocolatey Azure-Pipelines-Agent package, which grants all users in the Authenticated Users group write privileges fo...

Authorization

An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP request sent to the API. Reading or...

CVE-2022-3589 Miele: Vulnerability in cloud service used by appWash

An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP request sent to the API. Reading or...

Miele appWash 安全漏洞

Miele appWash is a laundry room digitization app from Miele Germany. Miele appWash suffers from an Access Control Error vulnerability that stems from the use of an API endpoint to bypass authorization checks. An attacker could use this vulnerability to gain read and partial write access to data...

PT-2022-22999 · Miele · Appwash Mobileapp

Name of the Vulnerable Software and Affected Versions: Miele AppWash MobileApp affected versions not specified Description: The issue concerns an API endpoint used by Miele's AppWash MobileApp, which was vulnerable to an authorization bypass. A low-privileged, remote attacker could gain read and...

Siemens syngo Dynamics has an unspecified vulnerability

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, a German company designed to be a centralized digital hub for complete cardiovascular services. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics suffers...

Siemens syngo Dynamics path traversal vulnerability

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, a German company designed to be a centralized digital hub for complete cardiovascular services. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics is...

Synology DiskStation Manager (DSM) 6.2.x < 6.2.4-25556-4 Samba Vulnerability (Synology-SA-22:02) - Remote Known Vulnerable Versions Check

Synology DiskStation Manager DSM is prone to an arbitrary code execution vulnerability in Samba. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2022-42893

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application...

CVE-2022-42891

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application...

CVE-2022-42891

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application...

CVE-2022-42892

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow directory listing in any folder accessible to the account assigned to the website’s applicati...