RUSTSEC-2024-0438 Wasmtime doesn't fully sandbox all the Windows device filenames

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8. For more information see the GitHub-hosted security advisory...

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-7315

The CVE-2024-7315 entry concerns the Migration, Backup, Staging WPvivid WordPress plugin (versions prior to 0.9.106). The root cause is insufficient randomness in the backup filename, which could be brute-forced to leak sensitive backup information. Impact: unauthenticated disclosure of sensitive...

PT-2024-32672 · Xz Utils · Xz Utils

Name of the Vulnerable Software and Affected Versions: XZ Utils versions 5.6.2 and older Description: The issue concerns a command line argument injection vulnerability in XZ Utils when built for native Windows. This occurs when Unicode characters in filenames are converted to similar-looking ASC...

Olgu Computer Systems e-Belediye 安全漏洞

Olgu Computer Systems e-Belediye is an application from Olgu Computer Systems. A security vulnerability exists in Olgu Computer Systems e-Belediye prior to version 2.0.642, which arises from incorrect privilege assignment of externally controlled filenames or paths, and allows manipulation of Web...

FreeBSD : FreeBSD -- NFS client accepts file names containing path separators (c02b8db5-771b-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c02b8db5-771b-11ef-9a62-002590c1f29c advisory. When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames fo...

The vulnerability of the binary archiver cpio lies in the improper limitation of the path name for the limited directory, allowing a hacker to trigger a service failure.

The vulnerability of the binary archiver cpio is related to a regression issue when the --no-absolute-filenames parameter is used. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

USN-6981-2 drupal7 vulnerabilities

USN-6981-1 fixed vulnerabilities in Drupal. This update provides the corresponding updates for Ubuntu 14.04 LTS. Original advisory details: It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue to execute arbitrary code...

CVE-2024-42471 Arbitrary File Write via artifact extraction in actions/artifact

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of actions/artifact on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted...

Microsoft IIS Shortname Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft IIS shortname vulnerability scanner', 'Description' = %q The vulnerability is caused by a tilde character "" in a GET or OPTIONS reques...

Ubuntu 16.04 LTS : Drupal vulnerabilities (USN-6981-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6981-1 advisory. It was discovered that Drupal incorrectly sanitized uploaded filenames. A remote attacker could possibly use this issue to execute arbitrary code...

Ubuntu 14.04 LTS : Vim vulnerabilities (USN-6965-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6965-1 advisory. It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted...

CVE-2024-42408

The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure...

CVE-2024-42408

The CVE-2024-42408 issue affects Dorsett Controls InfoScan (pre-1.38): the InfoScan client download page can be intercepted by a proxy, exposing locally stored filenames and potentially leading to information exposure. Root cause: path traversal in the download page handling allows leakage when a...

PT-2024-5970 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to the readdir3 function in the FreeBSD operating system, specifically when mounting a remote filesystem using NFS. The kernel does not properly sanitize remotely...

CVE-2024-6477

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...

CVE-2024-6477

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...

CVE-2024-6477 UsersWP < 1.2.12 - Users Information Disclosure

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...