NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

On October 6, 2022, the United States National Security Agency NSA released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China PRC states-sponsored cyber actors activity to seek national interests. These malicious cyber activities attributed to t...

Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

Summary This joint Cybersecurity Advisory CSA provides the top Common Vulnerabilities and Exposures CVEs used since 2020 by People’s Republic of China PRC state-sponsored cyber actors as assessed by the National Security Agency NSA, Cybersecurity and Infrastructure Security Agency CISA, and Feder...

WordPress String Locator Plugin < 2.5.0 Arbitrary File Read Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-45789

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...

CVE-2021-45789

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...

CVE-2021-45789

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...

CVE-2022-39261

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outsi...

CVE-2022-39261

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outsi...

Input validation

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outsi...

Hertz 路径遍历漏洞

Hertz is a Golang microservices HTTP framework open sourced by CloudWeGo. v0.3.0 of Hertz contains a path traversal vulnerability that stems from a failure of the normalizePath function to properly filter special elements in a resource or file path. An attacker could exploit this vulnerability to...

CVE-2022-39261

Twig is affected: versions 1.x before 1.44.7, 2.x before 2.15.3, and 3.x before 3.4.3 have a vulnerability where the filesystem loader can read arbitrary files when a template name is user-controlled (e.g., @namespace/../file) due to validation bypass. The fixed releases are 1.44.7, 2.15.3, and 3...

PT-2022-24853 · Twig +4 · Twig +4

Name of the Vulnerable Software and Affected Versions: Twig versions 1.x prior to 1.44.7 Twig versions 2.x prior to 2.15.3 Twig versions 3.x prior to 3.4.3 Description: The issue arises when the filesystem loader loads templates for which the name is a user input. It is possible to use the source...

MeterSphere 安全漏洞

MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere v1.15.4 version of a security vulnerability , the vulnerability stems from the existence of arbitrary file read vulnerability , authenticated users can read any file on the server through the file...

PT-2022-6820 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: A security issue exists in Zabbix Web Service Report Generation, which listens on port 10053. The service lacks proper validation for URL parameters before reading files, allowing for...

Design/Logic Flaw

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system...

SUSE: Security Advisory (SUSE-SU-2022:3321-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NOKIA 1350 OMS 路径遍历漏洞

NOKIA 1350 OMS is an optical management system from the Finnish company Nokia NOKIA. A security vulnerability exists in NOKIA 1350 OMS version R14.2. An attacker can exploit the vulnerability to arbitrarily read files on the file system...

NOKIA 1350 OMS 路径遍历漏洞

NOKIA 1350 OMS is an optical management system from the Finnish company Nokia NOKIA. A security vulnerability exists in NOKIA 1350 OMS version R14.2. An attacker can exploit the vulnerability to arbitrarily read files on the file system...

CVE-2022-2863 WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read

The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack...

KubeVirt vulnerable to arbitrary file read on host

Impact Users with the permission to create VMIs can construct VMI specs which allow them to read arbitrary files on the host. There are three main attack vectors: 1. Some path fields on the VMI spec were not properly validated and allowed passing in relative paths which would have been mounted in...