F5 BIG-IP iControl REST Authentication Bypass Vulnerability

F5 BIG-IP is an application delivery platform that integrates traffic management, DNS, inbound and outbound rules, web application firewall, web gateway, load balancing and other functions. F5 BIG-IP iControl REST authentication bypass vulnerability, the vulnerability is due to the authentication...

GHSA-9986-W5H5-VW59 Directory traversal in Mort Bay Jetty

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI...

CVE-2022-23700

A local unauthorized read access to files vulnerability was discovered in HPE OneView versions: Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView...

CVE-2022-22585

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files...

CVE-2021-41091

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where the data directory typically /var/lib/docker contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traver...

CVE-2021-33692

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories...

CVE-2021-25445

Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet...

SUSE SLED15: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc (SUSE-SU-2021:2471-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2471-1 advisory. - CVE-2021-3631: fix SELinux label generation logic bsc1187871 Tenable has extracted the preceding description block directly from the SUSE...

Unspecified vulnerability in QSAN Storage Manager (CNVD-2021-48966)

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A security vulnerability exists in QSAN Storage Manager, which can be exploited by remote attackers to create symbolic links and then access arbitrary files...

SAMSUNG Account 安全漏洞

Samsung Account is a cell phone account of the South Korean company Samsung Samsung. Samsung Account suffers from a redirection vulnerability that can be exploited by an attacker to access contact and file providers using the SettingWebView component...

Unspecified Vulnerability in Johnson Controls Metasys

Johnson Controls Metasys system is the United States Johnson Controls Johnson Controls company's set of building automation system. A security vulnerability exists in Johnson Controls Metasys version 11.0 and prior versions that can be exploited by an attacker to send specially crafted web messag...

Juniper Networks Junos OS 安全漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. A security vulnerability exists in Junos OS that could allow a locally authenticated user to access sensitiv...

ASUS BMC Firmware 路径遍历漏洞

ASUS BMC Firmware is a firmware from Asus China. A path traversal vulnerability exists in the ASUS BMC's firmware Web management page, which can be exploited by a remote attacker to gain administrator privileges and then access system files via path traversal...

CVE-2021-21725

A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by performing specific operations, resulting in information leak. This affects: ZXHN H196Q V9.1.0C2...

CVE-2021-21725

A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by performing specific operations, resulting in information leak. This affects: ZXHN H196Q V9.1.0C2...

CVE-2020-0479

In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app to access files available to the DocumentProvider without user permission, with no additional execution privileges needed. User interaction...

CVE-2020-0479

In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app to access files available to the DocumentProvider without user permission, with no additional execution privileges needed. User interaction...

CVE-2020-9114

FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause...

CVE-2020-13948

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...

Microsoft Outlook Information Disclosure Vulnerability (CNVD-2020-50144)

Microsoft Outlook is a suite of e-mail applications from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Outlook. An attacker could exploit the vulnerability to access specific files...