The vulnerability of the microprogramming software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND (9.0), and TL-WR841ND allows a hacker to bypass authentication procedures and read or write arbitrary files into the system.

The vulnerability of the microprogrammed software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND 9.0, and TL-WR841ND is related to incorrect restrictions on path names in the restricted access directory. Exploiting this vulnerability allows a malicious...

The vulnerability of the WYSIWYG editor Ckeditor arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to load arbitrary files.

The vulnerability of the WYSIWYG editor Ckeditor is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to download arbitrary files remotely...

The vulnerability of NVIDIA GeForce Experience’s software relates to an incorrect definition of the link before accessing the file, allowing a hacker to delete arbitrary data.

The vulnerability of NVIDIA GeForce Experience software relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a remote attacker to delete arbitrary data...

The vulnerability of the Apex One NT RealTime Scan service (ntrtscan.exe), an antivirus software solution provided by Trend Micro’s Apex One, exposes the system to potential threats. This vulnerability allows attackers to gain increased privileges.

The vulnerability of the Apex One NT RealTime Scan ntrtscan.exe component of Trend Micro’s Apex One and Apex One as a Service antivirus programs is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to increase their...

PT-2023-16007 · Canonical · Juju

Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.38 juju versions prior to 3.0.3 Description: An authenticated user who has read access to the juju controller model may construct a remote request to download an arbitrary file from the controller's filesystem...

The vulnerability in the `swift/common/middleware/s3api/etree.py` file of the S3 API interface for distributed object storage systems allows a perpetrator to gain unauthorized access to read any arbitrary files.

The vulnerability in the swift/common/middleware/s3api/etree.py file of the S3 API interface for distributed object storage systems in Swift is related to the use of files and directories accessible to external parties. Exploiting this vulnerability could allow an attacker to gain unauthorized...

CVE-2023-22777 Authenticated Information Disclosure in ArubaOS Web-based Management Interface

An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system...

openstack: Arbitrary file access through custom VMDK flat descriptor

A flaw was found in OpenStack-nova, Openstack-glance, and Openstack-cinder. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized...

openstack-swift: Arbitrary file access through custom S3 XML entities

A flaw was found in Swift's S3 XML parser. By supplying specially crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This issue impacts both s3api...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-cinder) security update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 17.0 Wallaby. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

openstack: Arbitrary file access through custom VMDK flat descriptor

A flaw was found in OpenStack-nova, Openstack-glance, and Openstack-cinder. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized...

Design/Logic Flaw

Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux Hitachi Infrastructure Analytics Advisor, Analytics probe server components, Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux Hitachi O...

Design/Logic Flaw

Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows Hitachi Ops Center Analyzer RAID Agent component allows local users to read and write specific files.This issue affects Hitachi Ops Center Analyzer: from 10.9.0-00 before 10.9.0-01...

Google Golang 路径遍历漏洞

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...

CVE-2023-26255

CVE-2023-26255 affects the STAGIL Navigation for Jira Menu & Themes plugin for Jira (before 2.0.52). Multiple sources confirm an unauthenticated path traversal/local file inclusion via the snjCustomDesignConfig endpoint when the fileName parameter is modified, enabling an attacker to read server ...

MGASA-2023-0066 Updated git packages fix security vulnerability

Using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source $GITDIR/objects directory contains symbolic links, the objects directory itself may still be a symbolic link. The...

Race condition

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

CVE-2023-23520

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

PT-2023-2004 · Hitachi · Hitachi Ops Center Analyzer

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Analyzer versions 10.9.0-00 through 10.9.0-00 Description: The issue is related to incorrect default permissions in the Hitachi Ops Center Analyzer RAID Agent component, allowing local users to read and write specific files...

PT-2023-2565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 113.0.5672.63 Description The issue is related to insufficient validation of untrusted input in Extensions, allowing an attacker who convinced a user to install a malicious extension to bypass file access checks...