CVE-2024-46648

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scanfolder...

eNMS 安全漏洞

eNMS is a network automation platform from eNMS Open Source. A security vulnerability exists in eNMS versions 4.4.0 through 4.7.1, which stems from vulnerability to directory traversal attacks via scanfolder...

PT-2024-32094 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions up to 4.7.1 Description: The issue is a Directory Traversal vulnerability, which occurs via the download/folder path. Recommendations: For versions up to 4.7.1, consider restricting access to the download/folder path as a...

eNMS 安全漏洞

eNMS is a network automation platform from eNMS Open Source. A security vulnerability exists in eNMS 4.7.1 and earlier versions, which stems from vulnerability to directory traversal attacks via download/folder...

PT-2024-32093 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions 4.4.0 through 4.7.1 Description: The issue is related to a Directory Traversal vulnerability in the scan folder feature. This vulnerability allows unauthorized access to sensitive files and directories. Recommendations: For eNMS...

CVE-2024-46649

eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder...

CVE-2024-46649: Improper Limitation of a Pathname to a Restricted Directory

eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder...

VulnCheck KEV: CVE-2023-34598

Gibbon v25.0.0 is vulnerable to a Local File Inclusion LFI where it's possible to include the content of several files present in the installation folder in the server's response...

PT-2024-40173 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: The issue concerns a path traversal vulnerability in the MediaController class. An attacker who has taken over an administrator account could potentially delete arbitrary files or...

GHSA-64VR-G452-QVP3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Summary We discovered a DOM Clobbering vulnerability in Vite when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled HTML elements e.g., an img tag with an unsanitized name...

CVE-2024-39613

Mattermost Desktop App versions =5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine...

How to Reset Account Lockout for 'Managed Hardened Repository ISO by Veeam'

Purpose This article documents how to unlock the accounts used with the Managed Hardened Repository ISO by Veeam, veeamsvc or vhradmin, when they become locked out. The Managed Hardened Repository ISO by Veeam deploys Rocky Linux with the DISA STIG security profile, which utilizes faillock to loc...

PT-2024-28554

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions =5.8.0 Description The Mattermost Desktop App fails to specify an absolute path when searching for the cmd.exe file, allowing a local attacker who can place a cmd.exe file in the user's Downloads folder to cause...

CVE-2024-27115

A unauthenticated Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution...

CVE-2024-27115

CVE-2024-27115 corresponds to an authenticated RCE in SOPlanning via PHP file upload. The nuclei template specifies exploitation of SOPlanning 1.52.01 through authenticated file upload, enabling an attacker to upload and execute PHP code. Remediation is to upgrade to a version newer than 1.52.01,...

CVE-2024-27115: Unrestricted Upload of File with Dangerous Type

A unauthenticated Remote Code Execution RCE vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution...

Arbitrary Code Execution

Apache Airflow is vulnerable to Arbitrary Code Execution. The vulnerability is due to DAG authors being able to add local settings to the DAG folder, which are then executed by the scheduler, allowing unintended code execution...

PYSEC-2024-212

Apache Airflow versions before 2.10.1 have a vulnerability that allowsDAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later,...

PT-2024-31385

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.10.1 Description The issue allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Use...

CVE-2024-7834

The CVE-2024-7834 entry concerns Overwolf. Affected: Overwolf software (frames/SDK) that loads and executes certain DLLs from a user-writable folder during startup, running in SYSTEM context. Root cause: untrusted DLLs placed in the user-writable location are loaded on launch, enabling local priv...