Multiple vulnerabilities in GroupSession

Overview GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 - CVE-2021-20874 Open redirect CWE-601 - CVE-2021-20875 Path Traversal CWE-22 - CVE-2021-20876 CVE-2021-20874 TAKUMA SHIGA...

CVE-2021-44159

CVE-2021-44159 concerns 4MOSAn GCB Doctor’s file upload function, where improper user privilege control allows an unauthenticated remote attacker to upload arbitrary files (including webshells) and potentially execute code, enabling arbitrary system operations or a denial of service. The vulnerab...

Japan Total System GroupSession 输入验证错误漏洞

Japan Total System GroupSession is a groupware project from Japan Total System to facilitate communication in businesses and organizations, designed to promote information sharing. A security vulnerability exists in GroupSession, which can be exploited by an attacker to access arbitrary files on...

Garrett Metal Detectors 路径遍历漏洞

Garrett Metal Detectors is a walk-in metal detector from Garrett, U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited to delete arbitrary files...

The vulnerability of the Jenkins automation server, related to incorrect authentication procedures, allows attackers to create arbitrary files.

The vulnerability of the Jenkins automation server is related to an incorrect authentication process. Exploiting this vulnerability allows a malicious actor to remotely create arbitrary files...

CVE-2021-41870

An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and upload arbitrary .php files...

Vulnerability fixed in SIMATIC eaSie PCS7

Siemens has fixed a vulnerability in SIMATIC eaSie PCS7. A authenticated malicious party can exploit the vulnerability to access arbitrary files via path-traversal on the vulnerable system. The download function in which the vulnerability is not activated by default. Siemens has released updates ...

SAP NetWeaver Directory Traversal (CVE-2016-3976)

A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in XStream, such as execution of arbitrary code, server-side request forgery, denial of service, bypassing security restrictions, and deletion of arbitrary files, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID: CVE-2020-26217 DESCRIPTION: XStream...

PT-2021-23207 · Openolat · Openolat

Name of the Vulnerable Software and Affected Versions: OpenOlat versions prior to 15.5.12 and 16.0.5 Description: A path traversal issue exists in OpenOlat, allowing an attacker to create directory structures and write files anywhere on the target system by providing a filename with a relative pa...

Grafana Directory Traversal (CVE-2021-43798)

A directory traversal vulnerability exists in Grafana. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

CVE-2021-37079

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arbitrary file by systemapp permission...

Protect

A download of code without integrity check vulnerability CWE-494 in the "execute restore src-vis" command of FortiOS may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages...

CVE-2021-43043

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

CVE-2021-43043

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

Design/Logic Flaw

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

CVE-2021-43043

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

Wiki.js 路径遍历漏洞

Wiki.js is Requarks.io team of a set of Node.js-based and written in JavaScript language open source Wiki software . A path traversal vulnerability exists in Wiki.js before 2.5.254, which allows directory traversal outside of the Wiki.js context when a storage module with local asset cache fetchi...

PT-2021-23732 · Kaseya +1 · Kaseya Unitrends Backup Appliance +1

Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered in the software where the apache user could read arbitrary files, such as /etc/shadow, by abusing an insecure Sudo rule. Recommendations: For...

jenkins: Creating symbolic links is possible without the symlink permission

A vulnerability was found in Jenkins which failed to correctly validate permissions. This flaw allowed any user to create symbolic links regardless if they had the symlink permission. It may allow an attacker to read and write to arbitrary files on the Jenkins controller file system...