5284 matches found
CVE-2022-30990
CVE-2022-30990 involves an information-disclosure vulnerability caused by insecure folder permissions in Acronis Cyber Protect 15 (Linux) before build 29240 and Acronis Agent (Linux) before build 28037. The issue’s root cause is improper access control on directories leading to exposure of sensit...
CVE-2022-30990 Sensitive information disclosure due to insecure folder permissions
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 Linux before build 29240, Acronis Agent Linux before build 28037...
CVE-2022-28955
An access control issue in D-Link DIR816LFW206b01 allows unauthenticated attackers to access folders folderview.php and categoryview.php...
CVE-2022-28955
An access control issue in D-Link DIR816LFW206b01 allows unauthenticated attackers to access folders folderview.php and categoryview.php...
PT-2022-20438 · Acronis · Acronis Agent +2
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 Linux versions before build 29240 Acronis Agent Linux versions before build 28037 Description: The issue is related to sensitive information disclosure due to insecure folder permissions. Recommendations: For Acronis...
D-Link DIR816 授权问题漏洞
The D-Link DIR816 is a wireless router from AUO D-Link of Taiwan, China. The D-Link DIR816L suffers from an Access Control Error vulnerability that stems from improper access control. An unauthenticated attacker could use this vulnerability to gain access to the folders folderview.php and...
CVE-2022-30990
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 Linux before build 29240, Acronis Agent Linux before build 28037...
Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in apps/common/templates/calculateformtitle.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a 1 tag or the 2 title of a source in a Staging folder, 3 Name field in a bootstrap setup, or Title fie...
CVE-2022-30697
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...
CVE-2022-30697 Local privilege escalation due to insecure folder permissions
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...
CVE-2022-30697
CVE-2022-30697 affects Acronis Snap Deploy for Windows before build 3640. Local privilege escalation due to insecure folder permissions on the host. CVSSv3.1 base score 7.8 (LOCAL, Privileges Required: LOW). No exploitation details are provided in the documents. Mitigation: upgrade to build 3640 ...
Privilege escalation
Trend Micro Password Manager Consumer version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be used for privilege escalation on the...
ROS-20220516-05
A vulnerability in the Git distributed version control system is related to the fact that the uninstaller binary downloads DLLs in an unsafe manner from the current working directory. uninstaller binary loads DLLs in an insecure manner from the current working directory. Exploitation of the...
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Cross-site scripting XSS vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site reque...
GHSA-4VWQ-X64Q-J4CJ Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Cross-site scripting XSS vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site reque...
GHSA-QGJQ-M78X-4GM8 Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...
Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...
GHSA-87VG-5PGX-PGGH spring-integration-zip Arbitrary File Write
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...
Cross-site Scripting (XSS)
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the admin/install.php script. An attacker can inject arbitrary JavaScript code by manipulating input fields such as $fdatabase, $fdbusername, and $fadminusername...