CVE-2023-42657

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations delete, rename, rmdir, mkdir on files and folders outside of their authorized WSFTP folder path. Attackers could also...

PT-2023-7548 · Honeywell · Honeywell Pm43

Name of the Vulnerable Software and Affected Versions: Honeywell PM43 versions prior to P10.19.050004 Description: The issue affects the Honeywell PM43 printer, specifically the 32-bit, ARM-based printer web page modules, allowing privilege escalation due to files or directories being accessible ...

Honeywell Products Security Breach

Honeywell Products is a line of products from Honeywell, Inc. A security vulnerability exists in Honeywell PM43 versions prior to P10.19.050004 that stems from the presence of a file or directory vulnerability that is accessible to external parties, allowing for privilege escalation...

Ivanti Addressed A New Zero-Day Flaw in Ivanti Sentry

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-38035 in Ivanti Sentry versions 9.18 and earlier allows unauthenticated access to sensitive APIs via port 8443, posing a risk of configuration manipulation and...

CVE-2023-32226

Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method...

U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████

An access control bypass vulnerability was discovered in Adobe ColdFusion, allowing attackers to bypass the restriction on external access to the ColdFusion Administrator...

Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD

Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and write access...

PYSEC-2023-9

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service...

CVE-2023-1246

Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations.This issue affects Starcities: through 1.3...

PT-2023-7987 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the use of files and directories accessible to external parties, potentially allowing a remote attacker to gain read-only access to the file system on behalf of the...

SUSE CVE-2007-0248

The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service crash by causing an externalacl queue overload, which triggers an infinite loop...

The vulnerability of Zyxel AX7501-B0 router microprogramming software, related to the use of files and directories accessible to external parties, allows a hacker to gain access to the root file system.

The vulnerability of Zyxel AX7501-B0 router microprogramming software is related to the use of files and directories accessible to external parties. Exploiting this vulnerability can allow a attacker to gain access to the root file system...

Malicious code in speedtestgod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42642a07abf71a7986c009eabcb9646de62538ed2712bed7492f7e6ee96e65d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-37424

Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery...

CVE-2022-37424

CVE-2022-37424 concerns OpenNebula on Linux. The vulnerability arises from the FILES directive, which may allow arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from a template, potentially causing Information Disclosure. Affected details (s...

CVE-2022-23768

This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device...

PT-2022-5098 · Unknown · Nis-Hap11Ac

Name of the Vulnerable Software and Affected Versions: NIS-HAP11AC affected versions not specified Description: The issue is related to insufficient access control in the NIS-HAP11AC wireless access point firmware. It allows a remote attacker to execute arbitrary code via the external telnet port...

Malicious code in crsosspsawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5828716e5e9932309d545a02aede3d1cc990b8b019ef2f1e2811ee3169b382e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exposure of critical functions

Lines of code Vulnerability details Impact AdminRole mixin exposes critical functions without any restrictions like grantAdmin revokeAdmin Proof of Concept Criticial functions like grantAdmin can be externally accessed changing the critical roles like admin. // for eg: function grantAdminaddress...

PT-2022-23989 · Unknown · Opennebula

Name of the Vulnerable Software and Affected Versions: OpenNebula affected versions not specified Description: The issue allows files or directories to be accessible to external parties, enabling file discovery. This affects OpenNebula on Linux. Recommendations: At the moment, there is no...