SUSE-SU-2022:0720-2 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23648: A specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host bsc1196441...

Ruby On Rails Directory Traversal (CVE-2016-0752)

A directory traversal vulnerability exists in Ruby on Rails. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Hubzilla 安全漏洞

Hubzilla is an open source platform for creating interconnected websites with a decentralized identity, communications and permissions framework built using common web server technology.Hubzilla version 7.2 previously contained a security vulnerability that could be exploited by remote attackers ...

CVE-2020-25150

CVE-2020-25150 describes a relative path traversal vulnerability in B. Braun Melsungen AG SpaceCom (versions L81/U61 and earlier) and Data module compactplus (versions A10 and A11). The underlying issue enables attackers with service-user privileges to upload arbitrary files via a crafted tar fil...

CVE-2020-25150 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute...

Ubuntu: Security Advisory (USN-5378-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries does not restrict the names of resources passed to the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system...

WordPress One Click Demo Import plugin文件上传漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress One Click Demo Import plugin has a file upload vulnerability, which originates from the plugin does not validate the importe...

CVE-2022-28213

CVE-2022-28213 concerns SAP BusinessObjects BI Platform (SOAP Web services) where XML input from an untrusted source is insufficiently validated, enabling XML External Entity (XXE) style behavior. Public entries identify affected releases as SAP BusinessObjects BI Platform 4.2/4.3; the issue can ...

PT-2022-3580 · Siemens · Sicam A8000 Cp-8050 +1

Name of the Vulnerable Software and Affected Versions: SICAM A8000 CP-8031 versions prior to V4.80 SICAM A8000 CP-8050 versions prior to V4.80 Description: A vulnerability has been identified that allows unauthenticated attackers to access certain files without requiring user authentication. This...

Newbee-mall code issue vulnerability

newbee-mall is an e-commerce system. newbee-mall v1.0.0 has a security vulnerability that can be exploited by attackers to upload arbitrary files via the upload function of /admin/goods/edit...

CVE-2022-27840

Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permission...

CVE-2022-28543

Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission...

CVE-2022-28543

Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission...

Path traversal

Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission...

CVE-2022-27840

SamsungRecovery prior to version 8.1.43.0 contains an improper access control vulnerability that allows a local attacker to delete arbitrary files with SamsungRecovery permissions. The issue is confirmed across multiple sources and is mitigated by upgrading to 8.1.43.0 or later. If upgrading is n...

CVE-2022-1008

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed...

CVE-2022-1008

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed...

Samsung Recovery 安全漏洞

Samsung Recovery is a program for recovering the current state of a disk or backup disk from Samsung South Korea.An access control error vulnerability exists in versions prior to Samsung Recovery 8.1.43.0, which stems from the presence of incorrect access control in SamsungRecovery. A local...

Remote Code Execution

Gzip is vulnerable to remote code execution. Insufficient validations when processing filenames with two or more newlines allow remote attackers to force zgrep or xzgrep to write arbitrary files on the system...