CVE-2021-25020: Improper Limitation of a Pathname to a Restricted Directory

The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin...

Azure App Service Linux source repository exposure

MSRC was informed by Wiz.io, a cloud security vendor, under Coordinated Vulnerability Disclosure CVD of an issue where customers can unintentionally configure the .git folder to be created in the content root, which would put them at risk for information disclosure. This, when combined with an...

Security Bulletin: Vulnerability in Apache Log4j affects IBM SPSS Analytic Server (CVE-2021-44228)

Summary There is a vulnerability in the version of Apache Log4j that was installed in IBM SPSS Analytic Server. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, cause...

VulnCheck KEV: CVE-2012-3015

Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder...

Exchange backup fails at "TeamsMessagesData" folder

Challenge Backup of an Exchange mailbox fails with the error: Failed to synchronize item changes in folder: TeamsMessagesData Copy Solution A stop-gap workaround for this error has been included with Veeam Backup for Microsoft 365 5d cumulative patch KB4235. This fix will cause the...

Multiple vulnerabilities in Trend Micro Security 2021 family (Consumer)

Overview Trend Micro Incorporated has released security updates for Trend Micro Security 2021 family Consumer. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Maximum Security 2021 A user who can log in to the system where...

Fortinet FortiClient security vulnerabilities

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. It provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient, which can...

CVE-2021-39135

A flaw was found in nodejs-arborist. Arborist could write package dependencies to any arbitrary location on the file system if an attacker had replaced a project folder with a symbolic link in the nodemodules folder. The highest threat from this vulnerability is to data integrity and system...

CVE-2021-43772

Trend Micro Security 2021 v17.0 Consumer contains a vulnerability that allows files inside the protected folder to be modified without any detection...

PT-2021-23923

Name of the Vulnerable Software and Affected Versions: Trend Micro Security 2021 version 17.0 Description: The issue allows files inside the protected folder to be modified without any detection. Recommendations: For Trend Micro Security 2021 version 17.0, at the moment, there is no information...

WordPress OMGF | Host Google Fonts Locally plugin <= 4.5.11 - Arbitrary Folder Deletion via Path Traversal vulnerability

Arbitrary Folder Deletion via Path Traversal vulnerability discovered by José Aguilera in WordPress OMGF | Host Google Fonts Locally plugin versions = 4.5.11. Solution Update the WordPress OMGF | Host Google Fonts Locally plugin to the latest available version at least 4.5.12...

CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin As admin, put the following payload in the "Cache directory for analytics.js" setting of the plugin: ../wp-includes, tic...

OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin PoC As admin, put the following payload in the "Fonts Cache Directory" setting of the plugin: ../wp-includes, tick the...

OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin As admin, put the following payload in the "Fonts Cache Directory" setting of the plugin: ../wp-includes, tick the "Remo...

Trend Micro Security security feature bug

Trend Micro Security is a suite of computer security protection software from Trend Micro. A security feature issue vulnerability exists in Trend Micro Security that stems from an unspecified error in the Folder Shield feature. A local user can modify files within a Folder Shield-protected folder...

[SECURITY] Fedora 34 Update: roundcubemail-1.4.12-1.fc34

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Storefront upgrade error : 'Storefront cannot be upgraded because the following folders are in use by another program'

Storefront cannot be upgraded because the following folders are in use by another program. Close the program and try again: C:\inetpub\wwwroot\Citrix\apps\AppData C:\inetpub\wwwroot\Citrix\appsAuth...

Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Adobe Creative Cloud. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product...

GHSA-PPQ7-88C7-Q879 Cross-Site Request Forgery in PiranhaCMS

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery CSRF when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known...

Cross-Site Request Forgery in PiranhaCMS

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery CSRF when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known...