CVE-2024-53283

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Router Port Forward functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...

CVE-2024-53285

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in DDNS Record functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitiv...

CVE-2024-53284

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect Setting functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...

CVE-2024-53280

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in network center policy route functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files...

CVE-2024-53281

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Network WOL functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users to read or write specific files containing non-sensitive information and conduct...

CVE-2024-53279

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in file station functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensiti...

CVE-2024-43415

CVE-2024-43415 — A SQL injection in the decidim_awesome-module (papertrail/version-model) allows an authenticated admin to manipulate SQL queries in vulnerable versions (0.9.0–0.11.1). This can lead to information disclosure, filesystem read/write, or remote code execution. Root cause: improper n...

CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...

jj vulnerable to path traversal via crafted Git repositories

Impact Specially crafted Git repositories can cause jj to write files outside the clone. Patches Fixed in 0.23.0. Workarounds Not much other than to not clone repositories from untrusted sources. References Here's the original report from @joernchen: When cloning a crafted Git repository it is...

CVE-2024-51990: Improper Limitation of a Pathname to a Restricted Directory

jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause jj to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to upgrade should avoid cloning repos from...

CVE-2024-47253: Improper Limitation of a Pathname to a Restricted Directory

In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to write files on the filesystem and potentially achieve arbitrary remote code execution. This vulnerability cannot be exploited by users with lower privilege...

Apache ActiveMQ Artemis security vulnerabilities

Apache ActiveMQ Artemis is a high-performance open source messaging agent from the Apache USA Foundation. A security vulnerability exists in Apache ActiveMQ Artemis versions prior to 2.29.0, which stems from allowing access to diagnostic information and controls via MBean, which allows an attacke...

CentOS 7 : buildah (RHSA-2020:2116)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory. - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious containe...

PT-2024-7658

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.07.3 Description The issue is related to errors in handling relative paths to directories in the continuous integration and delivery system CI/CD JetBrains TeamCity. Exploitation of this issue may allo...

CVE-2024-43387 Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices

A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAILRELAYPASSWORD in mGuard devices...

CVE-2024-7634

NGINX Agent's "configdirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory...

CVE-2024-7634: Improper Limitation of a Pathname to a Restricted Directory

NGINX Agent's "configdirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory...

GitLab Git LFS Token Processing Unauthorized Access Arbitrary File Write

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an error in token processing for LFS operations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information and...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 6.27.0.113, which stemmed from an improper input validation issue in...

PT-2024-26870 · Kalkitech · Kalkitech Ase Ase61850 Iedsmart

Name of the Vulnerable Software and Affected Versions: Kalkitech ASE ASE61850 IEDSmart versions 2.3.5 and earlier Description: The issue allows attackers to read and write arbitrary files via the IEC61850 File Transfer protocol. This is a result of a Directory Traversal vulnerability...