CVE-2023-37243

The vulnerability CVE-2023-37243 concerns the Windows Atera Agent Package Availability (Agent.Package.Availability.exe). The executable is launched with SYSTEM privileges at reboot, and its folder (C:\Windows\Temp\Agent.Package.Availability) inherits permissions from C:\Windows\Temp; this enables...

CVE-2023-37243

The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Package.Availability.exe is susceptible t...

Dropbox Folder Share <= 1.9.7 - Unauthenticated Remote Code Execution via LFI

Description The plugin does not validate the path and name of a file before including it, allowing unauthenticated visitors to include and execute arbitrary php files on the server, leading to remote code execution...

Design/Logic Flaw

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

CVE-2021-26734 Junction Delete leading to elevation of privilege

Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context...

PT-2023-21973 · Zscaler · Zscaler Client Connector For Windows

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector for Windows versions prior to 4.1 Description: The issue allows a malicious user to execute code as a privileged user by replacing a folder where the Zscaler Client Connector for Windows writes or deletes a...

Zscaler Client Connector Backlink Vulnerability

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

OESA-2023-1744 libcue security update

Libcue is intended for parsing a so-called cue sheet from a char string or a file pointer. For handling of the parsed data a convenient API is available. Security Fixes: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bound...

CVE-2023-4488

The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi...

Design/Logic Flaw

The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi...

CVE-2023-4488 Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion

The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi...

CVE-2023-4488 Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion

The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi...

CVE-2023-4488

CVE-2023-4488 refers to the Dropbox Folder Share for WordPress. Connected sources confirm an unauthenticated Local File Inclusion (LFI) via editor-view.php affecting versions up to and including 1.9.7, enabling attackers to include/execute arbitrary PHP files on the server. Impact statements indi...

WordPress Plugin Dropbox Folder Share Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-35181

The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation...

CVE-2023-35181

The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation...

Privilege escalation

The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation...

SolarWinds Access Rights Manager Security Vulnerability

SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A security vulnerability exists in SolarWinds Access Rights Manager that stems from allowing a user to abuse incorrect folder permissions, which can lead to privilege escalation...

PT-2023-29313 · WordPress · Dropbox Folder Share

Name of the Vulnerable Software and Affected Versions: Dropbox Folder Share for WordPress versions up to, and including, 1.9.7 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the editor-view.php file. This enables the execution of a...

CVE-2023-43801

CVE-2023-43801 affects the Arduino Create Agent, specifically the endpoint /v2/pkgs/tools/installed. A user able to make HTTP requests to the localhost interface or bypass CORS can delete arbitrary files/folders owned by the Arduino Create Agent’s running user via a crafted HTTP DELETE request. R...