CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

PT-2023-23267 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The file download facility does not sufficiently sanitize file paths in certain situations, potentially allowing users to access private files they should not have access to. Some sites may...

CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

CVE-2023-31250 Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

Zyxel ATP 安全漏洞

The Zyxel ATP is a firewall from China's Hopkins Zyxel. A security vulnerability exists in Zyxel ATP Series 5.10 through 5.35 firmware versions, USG FLEX Series 5.00 through 5.35 firmware versions, USG FLEX 50W 5.10 through 5.35 firmware versions, USG20W-VPN 5.10 through 5.35 firmware versions, a...

Drupal 7.x < 7.96 / 9.4.x < 9.4.14 / 9.5.x < 9.5.8 / 10.x < 10.0.8 Drupal Vulnerability (SA-CORE-2023-005)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.96, 9.4.x prior to 9.4.14, 9.5.x prior to 9.5.8, or 10.x prior to 10.0.8. It is, therefore, affected by a vulnerability. - The file download facility doesn't sufficiently sanitize fil...

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

CVE-2023-23594

An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes...

Authentication flaw

An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes...

CVE-2023-23594

An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes...

PT-2023-19066 · Cl4Nx · Cl4Nx

Name of the Vulnerable Software and Affected Versions: CL4NX printer versions prior to 1.13.3-u724 r2 Description: An authentication bypass issue in the web client interface of the CL4NX printer allows remote unauthenticated attackers to execute commands intended for valid and authenticated users...

CVE-2023-26358

Creative Cloud version 5.9.1 and earlier is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources...

CVE-2023-27234

A Cross-Site Request Forgery CSRF in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application...

CVE-2023-27234

A Cross-Site Request Forgery CSRF in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application...

CVE-2023-27234

A Cross-Site Request Forgery CSRF in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application...

JIZHICMS 跨站请求伪造漏洞

JIZHICMS JIZHICMS is an open source Content Management System CMS from China's JIZHICMS Network Technology Company. A security vulnerability exists in JIZHICMS v2.4.5, which originates from a vulnerability in /Sys/index.html that allows an attacker to arbitrarily change the configuration within t...

CVE-2023-27234

CVE-2023-27234 is a CSRF vulnerability in Jizhicms v2.4.5 affecting the /Sys/index.html endpoint, enabling an attacker to arbitrarily change configuration with user interaction. Root cause: CSRF due to insufficient request validation. Impact: potential configuration modifications; CVSSv3.1 base s...

CVE-2023-27234

A Cross-Site Request Forgery CSRF in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application...

CVE-2023-20011

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system...