CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-34457: Improper Access Control

Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non-admin to modify the files inside installed directory and...

Microsoft Windows Installer Service Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows...

PT-2023-14418 · Ge Grid Solutions · Fc46-Webbridge

Name of the Vulnerable Software and Affected Versions: FC46-WebBridge on GE Grid Solutions MS3000 devices versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0 Description: An issue was discovered that allows direct access to the API on TCP port 8888 via programs located in the cgi-bin folder without any...

GHSA-5V8V-GWMW-QW97 org.neo4j.procedure:apoc Path Traversal Vulnerability

Impact A Path Traversal Vulnerability found in the apoc.export. procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the...

CVE-2023-0293

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

Authorization

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

CVE-2023-0293 Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to chan...

shuttle-secrets (>=0.6.0, <=0.7.2), shuttle-static-folder (0.7.3-rc.1) potentially affected by unknown CVE via tokio (1.20.1)

tokio CARGO version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - shuttle-secrets =0.6.0, =0.7.2 - shuttle-static-folder 0.7.3-rc.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

shuttle-persist (>=0.8.0, <=0.10.0), shuttle-secrets (>=0.8.0, <=0.10.0) +3 more potentially affected by unknown CVE via tokio (>=1.21.2, <=1.22.0)

tokio CARGO version =1.21.2, =0.8.0, =0.8.0, =0.8.0, =0.10.0 - uff 0.1.0 - wakuchin 0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

PT-2023-18789 · Unknown · Shibboleth Service Provider

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider SP versions prior to 3.4.1 Description: The issue concerns insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP. This allows an unprivileged local attacker to escalate...

Shibboleth code vulnerabilities

Shibboleth is an open source SAML protocol Web Single Sign-On system for Windows from Shibboleth, UK. A security vulnerability exists in Shibboleth Service Provider SP Windows versions prior to 3.4.1, which stems from the installation being located under C:opt instead of C:Program Files by defaul...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

WordPress Slider Revolution 4.6.5 Shell Upload

==================================================================================================================================== | Title : WordPress - Slider Revolution 4.6.5 WordPress - Slider Revolution 4.6.5 shell upload 0-day exploit | | Author : indoushka | | Tested on : windows 10...

shuttle-secrets (>=0.6.0, <=0.7.2), shuttle-static-folder (0.7.3-rc.1) potentially affected by CVE-2023-22466 via tokio (1.20.1)

tokio CARGO version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - shuttle-secrets =0.6.0, =0.7.2 - shuttle-static-folder 0.7.3-rc.1 Source cves: CVE-2023-22466 Source advisory: OSV:GHSA-7RRJ-XR53-82P7...

shuttle-secrets (>=0.6.0, <=0.7.2), shuttle-static-folder (0.7.3-rc.1) potentially affected by CVE-2023-22466 via tokio (1.20.1)

tokio CARGO version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio and may be impacted: - shuttle-secrets =0.6.0, =0.7.2 - shuttle-static-folder 0.7.3-rc.1 Source cves: CVE-2023-22466 Source advisory: GHSA-7RRJ-XR53-82P7...

shuttle-persist (>=0.8.0, <=0.10.0), shuttle-secrets (>=0.8.0, <=0.10.0) +3 more potentially affected by CVE-2023-22466 via tokio (>=1.21.2, <=1.22.0)

tokio CARGO version =1.21.2, =0.8.0, =0.8.0, =0.8.0, =0.10.0 - uff 0.1.0 - wakuchin 0.3.0 Source cves: CVE-2023-22466 Source advisory: GHSA-7RRJ-XR53-82P7...