384 matches found
The vulnerability of the Welcart eCommerce plugin for the WordPress content management system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Welcart eCommerce plugin for the WordPress content management system is related to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow an attacker who operates remotely to gain unauthorized access to protected...
Exploit for Files or Directories Accessible to External Parties in Redhat Ansible_Tower
CVE-2021-20253: Privilege Escalation via Job Isolation Escape...
Malicious code in purchase (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 818b7cf6f19f5659849b9ba6ea11d5b53b47330d31838d371590e07f9107bfe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Home Assistant Security Breach
Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home assistant versions prior to 2023.9.0, which stems from a security flaw in the component webhook that allows an attacker to...
CVE-2023-5101
Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...
Functions can be called directly externally
Lines of code Vulnerability details Impact @dev This exists as a standalone contract but will only ever contain proxy code, not state. As such it should never be called directly or externally, and should only be invoked with DELEGATECALL so that it operates on the contract state within the primar...
CVE-2023-42657
In WSFTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations delete, rename, rmdir, mkdir on files and folders outside of their authorized WSFTP folder path. Attackers could also...
Honeywell Products Security Breach
Honeywell Products is a line of products from Honeywell, Inc. A security vulnerability exists in Honeywell PM43 versions prior to P10.19.050004 that stems from the presence of a file or directory vulnerability that is accessible to external parties, allowing for privilege escalation...
PT-2023-7548 · Honeywell · Honeywell Pm43
Name of the Vulnerable Software and Affected Versions: Honeywell PM43 versions prior to P10.19.050004 Description: The issue affects the Honeywell PM43 printer, specifically the 32-bit, ARM-based printer web page modules, allowing privilege escalation due to files or directories being accessible ...
Ivanti Addressed A New Zero-Day Flaw in Ivanti Sentry
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-38035 in Ivanti Sentry versions 9.18 and earlier allows unauthenticated access to sensitive APIs via port 8443, posing a risk of configuration manipulation and...
CVE-2023-32226
Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method...
U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████
An access control bypass vulnerability was discovered in Adobe ColdFusion, allowing attackers to bypass the restriction on external access to the ColdFusion Administrator...
Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD
Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and write access...
PYSEC-2023-9
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...
CVE-2023-1246
Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations.This issue affects Starcities: through 1.3...
PT-2023-7987 · Zabbix +4 · Zabbix +4
Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the use of files and directories accessible to external parties, potentially allowing a remote attacker to gain read-only access to the file system on behalf of the...
SUSE CVE-2007-0248
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service crash by causing an externalacl queue overload, which triggers an infinite loop...
The vulnerability of Zyxel AX7501-B0 router microprogramming software, related to the use of files and directories accessible to external parties, allows a hacker to gain access to the root file system.
The vulnerability of Zyxel AX7501-B0 router microprogramming software is related to the use of files and directories accessible to external parties. Exploiting this vulnerability can allow a attacker to gain access to the root file system...
Malicious code in speedtestgod (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42642a07abf71a7986c009eabcb9646de62538ed2712bed7492f7e6ee96e65d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...