The vulnerability of the Windows Container Manager service on Windows operating systems allows a hacker to escalate their privileges.

The vulnerability of the Windows Container Manager service in Windows operating systems is related to incorrect handling of symbolic links before accessing files. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the microprogramming software of Schneider Electric’s programmable logic controller Modicon M340 and its network modules, Modicon M340 BMXNOE0100, Modicon M340 BMXNOE0110, stems from the use of files and directories accessible to external parties. This allows attackers to disrupt the device’s firmware updates and cause improper operation of the web server.

The vulnerability of the microprogramming software of Schneider Electric’s programmable logic controller Modicon M340, as well as its network modules Modicon M340 BMXNOE0100 and Modicon M340 BMXNOE0110, stems from the use of files and directories accessible to external parties. Exploiting this...

PT-2024-31349 · Lollms +1 · Lollms +2

Name of the Vulnerable Software and Affected Versions: lollms version 9.6 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server due to a lax CORS policy, allowing attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage. This...

PT-2024-27967

Name of the Vulnerable Software and Affected Versions cyclonedx-core-java versions prior to 9.0.4 Description The CycloneDX core module provides a model representation of SBOMs and utilities for creating, validating, and parsing them. Before deserializing CycloneDX Bill of Materials in XML format...

PT-2024-25526 · Virtosoftware · Virto Bulk File Download

Name of the Vulnerable Software and Affected Versions: VirtoSoftware Virto Bulk File Download version 5.5.44 for SharePoint 2019 Description: An issue was discovered that allows arbitrary file download and deletion via absolute path traversal in the path parameter of the isCompleted method in the...

The vulnerability of Themes component in the Windows operating system, which allows a hacker to trigger a service failure

The vulnerability of Themes component in the Windows operating system is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to cause a service failure...

Arbitrary File Access

magento/community-edition is vulnerable to arbitrary file access. The vulnerability is due to an issue in the file upload controller for downloadable products, allowing an authenticated user to read or delete arbitrary files. Attackers can exploit this vulnerability to gain unauthorized access to...

U.S. Dept Of Defense: XML E██████ternal Entity (XXE) Injection in ███

The vulnerability described in CVE-2022-2414 was an XML External Entity XXE injection flaw. XXE vulnerabilities occur when an application improperly processes XML input containing references to external entities. This allowed access to arbitrary files on the server...

PT-2024-4674 · Huawei · Huawei Home Music System +1

Name of the Vulnerable Software and Affected Versions: Huawei home music system products affected versions not specified Description: The issue is related to a path traversal vulnerability in some Huawei home music system products. This vulnerability may allow an attacker to delete or change file...

The vulnerability of the Microsoft Office suite arises from the improper handling of symbolic links before accessing a file, allowing an attacker to execute arbitrary code.

The vulnerability of the Microsoft Office package is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Adobe Acrobat Android Path Traversal Vulnerability

Adobe Acrobat is the United States of America Odo than Adobe company's set of PDF file editing and conversion tools. A path traversal vulnerability exists in Adobe Acrobat Android version 24.4.2.33155 and prior versions, which stems from the program failing to properly filter for special elements...

PT-2024-27080 · Unknown · Badger-Database

Name of the Vulnerable Software and Affected Versions: abw badger-database version 1.2.1 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code. This is achieved via the dist/badger-database.esm file. Recommendations: For version 1.2.1, consider restricting access t...

The vulnerability of the data collection tool for Azure Monitor Agents from virtual machines and physical servers arises from incorrect handling of the link before accessing the file. This allows attackers to escalate their privileges.

The vulnerability of the data collection tool for Azure Monitor Agents, which are used for monitoring virtual machines and physical servers, is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow attackers to increase their privilege...

CVE-2024-34129

Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to access files and directories...

cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

The vulnerability of the file system for pervasive access 9p (9pfs) in the QEMU hardware emulation software allows a perpetrator to circumvent existing access control policies.

The vulnerability of the 9pfs file system, a hypervisor-based emulator of QEMU, is related to the absence of a prohibition on opening specific files on the host side. Exploiting this vulnerability can allow a perpetrator to circumvent existing access control policies...

CVE-2024-5154

The CVE-2024-5154 entry concerns a vulnerability in the cri-o component used by Red Hat OpenShift/OpenShift Container Platform where a malicious container can traverse directories (../) to read/write arbitrary host files due to improper symbolic link validation. Affected products include CRI-O wi...

CVE-2024-5154 Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

CRI-O Security Vulnerabilities

CRI-O is a lightweight container runtime environment for Kubernetes systems. A security vulnerability exists in CRI-O that stems from the presence of a directory traversal vulnerability that allows reading and writing arbitrary files on the host system...

PT-2024-4268

Name of the Vulnerable Software and Affected Versions Windows Container Manager Service affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Windows Container Manager Service. It is caused by incorrect handling of symbolic links before...