Red Hat Enterprise Linux Posting Link Vulnerabilities

Red Hat Enterprise Linux versions 10, 7, 8, and 9 have a post-installation link vulnerability. This vulnerability arises because Nautilus does not verify whether the path to the recycle bin directory is a symbolic link when uninstalling or ejecting removable drives or disk images. An attacker can...

WHEELS.DEV: Wheel

WHEELS.DEV: In versions 4.0.0 to 4.1.2, there is a vulnerability related to input validation errors. This vulnerability stems from the use of case-insensitive comparisons on a case-sensitive file system. As a result, the checks for standard paths of zip entries, package maps, development...

MZ Automation GmbH libIEC61850 Digital Error Vulnerability

MZ Automation GmbH’s libIEC61850 versions prior to 1.6.2 have security vulnerabilities. These vulnerabilities stem from the MMS file service accepting an excessive initialPosition during fileOpen and saving it to the file read state. The fileRead path uses unsigned arithmetic to subtract the larg...

Red Hat Enterprise Linux numerical error vulnerabilities

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a numerical error vulnerability. This vulnerability stems from an integer overflow that occurs during the calculation of the memory buffer size for image dimensions by the GIMP’s file-pvr plugin. Attackers can exploit this vulnerability by...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...

Kitae Park Mang Board arbitrary file upload vulnerability

Kitae Park’s Mang Board version 2.4.4 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the mbwfileUpload function, which fails to validate the file extension of the imagepath parameter provided by the attacker. The function relies on the basename o...

Helicalinsight path traversal vulnerability

Helicalinsight 7.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from the path parameter in the getExternalResource function, which allows authenticated users to access files outside of the solution directory. Attackers can provide any readable file with...

CoAI.Dev path traversal vulnerability

CoAI.Dev 4.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from unvalidated path traversal vulnerabilities in the endpoints for generating and archiving articles. Attackers can use hash query parameters to download arbitrary .tar.gz or .zip files, including...

ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version from 0.1.0 to 0.3.3 had vulnerabilities related to permission management and access control. These vulnerabilities stemmed from incorrect DBus policies in the lomiri-upload-manager component, allowing any user to read arbitrary files with root privilege...

5rahim Seanime command injection vulnerability

The 5rahim Seanime version from 3.7.0 to 3.10.3 has a command injection vulnerability. This vulnerability arises due to improper authorization; unauthenticated LAN or Tailnet clients can bypass the media stream settings. By using the transcodeHwAccelCustomSettings field, they can append...

WordPress YaySMTP arbitrary file upload vulnerability

WordPress versions prior to YaySMTP 2.7.7 have a vulnerability related to file uploads. This vulnerability stems from insufficient file type validation in the putFile function. Additionally, the sanitizefilename function does not remove executable extensions, and it does not apply allowlists, MIM...

DoubleScale CRM arbitrary file upload vulnerability

DoubleScale CRM versions 1.5.1 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the storeupload function, which allows for arbitrary file uploads. The extensionisallowed function, which is responsible for checking whether files with unrecognized...

IBM i Permission Licensing and Access Control Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from a lack of subtree checks during file handle parsing, which may allow local attackers to obtain sensitive information...

Thermo Fisher Scientific Torrent Suite Software path traversal vulnerability

Thermo Fisher Scientific Torrent Suite Software versions 5.18 and earlier have a path traversal vulnerability. This vulnerability allows for attacks due to path traversal, potentially enabling authenticated attackers to access any file accessible by Web service accounts on the Torrent Server...

Groundhogg path traversal vulnerability

Groundhogg versions 4.9.3 and earlier have a path traversal vulnerability. This vulnerability stems from insufficient file path validation in the copyfile function. As a result, authenticated attackers with access levels of Sales Representative or higher, or those who have the ability to import...

Javahuang SurveyKing Authorization Issue Vulnerability

Javahuang SurveyKing versions prior to 1.13.0 have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Unverified attackers can download any stored file through the GET /api/public/preview/attachmentId interface. They can also bypass the...

WordPress ELEX – WordPress HelpDesk & Customer Ticketing System: Arbitrary File Upload Vulnerability

WordPress ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.7 and earlier have an arbitrary file upload vulnerability. This vulnerability stems from the initMailPart function, which does not properly validate the file type when saving IMAP email attachments. This allows unauthorize...

Openwave Webtop Media Transcoder: Permissions, licensing, and access control issues

Openwave Webtop Media Transcoder versions prior to 1.1.22.0 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the lack of enforcement of file type restrictions defined by administrators, which may allow authenticated users to bypass the...

Nezhahq Nezha resource management error vulnerability

Versions of Nezhahq Nezha from 2.0.13 to 2.3.15 have a resource management vulnerability. This vulnerability stems from the lack of restrictions on concurrent connections at the/api/v1/ws/transfer WebSocket endpoint. Authorized attackers can create numerous ServerTransferClass.Subscribe...

Nezhahq Nezha resource management error vulnerability

In versions from 1.0.0 to 2.3.15, there was a resource management error vulnerability in the dashboard file manager. This vulnerability stemmed from the fact that the fmStream in the WebSocket endpoint of the file manager did not call SetReadLimit. As a result, the message size became unlimited,...