Important: Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-cinder) security update

An update for openstack-cinder is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Important: Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-glance) security update

An update for openstack-glance is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

openstack: Arbitrary file access through custom VMDK flat descriptor

A flaw was found in OpenStack-nova, Openstack-glance, and Openstack-cinder. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized...

openstack-swift: Arbitrary file access through custom S3 XML entities

A flaw was found in Swift's S3 XML parser. By supplying specially crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This issue impacts both s3api...

The vulnerability of the FortiOS operating systems arises from incorrect restrictions on path names to restricted directories, allowing attackers to read and write arbitrary files.

The vulnerability of the FortiOS operating systems is related to incorrect restrictions on path names to restricted directories. Exploiting this vulnerability allows an attacker to read and write arbitrary files by executing commands in the command line interface...

NETGEAR Nighthawk 安全漏洞

NETGEAR Nighthawk is a series of wireless routers from NETGEAR. A security vulnerability exists in versions prior to NETGEAR Nighthawk WiFi6 Router V1.0.10.94, which stems from the fact that the device contains a file sharing mechanism that can be exploited by an attacker to access arbitrary file...

CVE-2023-22892

There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances...

The vulnerability of the microprogramming software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND (9.0), and TL-WR841ND allows a hacker to bypass authentication procedures and read or write arbitrary files into the system.

The vulnerability of the microprogrammed software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND 9.0, and TL-WR841ND is related to incorrect restrictions on path names in the restricted access directory. Exploiting this vulnerability allows a malicious...

The vulnerability of the WYSIWYG editor Ckeditor arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to load arbitrary files.

The vulnerability of the WYSIWYG editor Ckeditor is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to download arbitrary files remotely...

The vulnerability in the `swift/common/middleware/s3api/etree.py` file of the S3 API interface for distributed object storage systems allows a perpetrator to gain unauthorized access to read any arbitrary files.

The vulnerability in the swift/common/middleware/s3api/etree.py file of the S3 API interface for distributed object storage systems in Swift is related to the use of files and directories accessible to external parties. Exploiting this vulnerability could allow an attacker to gain unauthorized...

openstack: Arbitrary file access through custom VMDK flat descriptor

A flaw was found in OpenStack-nova, Openstack-glance, and Openstack-cinder. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized...

openstack-swift: Arbitrary file access through custom S3 XML entities

A flaw was found in Swift's S3 XML parser. By supplying specially crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This issue impacts both s3api...

openstack: Arbitrary file access through custom VMDK flat descriptor

A flaw was found in OpenStack-nova, Openstack-glance, and Openstack-cinder. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-cinder) security update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 17.0 Wallaby. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2022-39954

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5,...

GitHub Enterprise Server 路径遍历漏洞

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. GitHub Enterprise Server version before 3.7.6 has a security vulnerability , the...

SUSE CVE-2004-0411

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a 1 telnet, 2 rlogin, 3 ssh, or 4 mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files...

SUSE CVE-2008-1145

Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash \ path separators or case-insensitive file names, allows remote attackers to access arbitrary files via 1 "..%5c" encoded backslash...

SUSE CVE-2009-2200

WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document...

SUSE CVE-2009-2701

Unspecified vulnerability in the Zope Enterprise Objects ZEO storage-server functionality in Zope Object Database ZODB 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via...