6395 matches found
CVE-2024-35219
A flaw was found in OpenAPI generator, where it allows the generation of API client libraries, for example, SDK generation, server stubs, documentation, and configuration, automatically given an OpenAPI Spec. This flaw allows an attacker to cause a path traversal vulnerability to read and delete...
CVE-2024-35219 OpenAPI Generator Online - Arbitrary File Read/Delete
OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary,...
PT-2024-5292 · Unknown · Openapi Generator
Name of the Vulnerable Software and Affected Versions: OpenAPI Generator versions prior to 7.6.0 Description: The issue is related to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to bypass security restrictions a...
OESA-2024-1631 nautilus security update
It's easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop. Security Fixes: GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename...
How to remove a user from a shared Mac
There will be times when you need to remove a user from a device. In this article well show you how to remove a user from a Mac. For a better understanding its good to understand the difference between an actual user of the device and a "sharing only user." On a Mac, you can use Sharing Only User...
Exploit for Use of Hard-coded Credentials in Dlink Dns-320L_Firmware
Dinkleberry 🫐 Are you one of the 92,000+ people1 stuck with a...
WordPress SP Project & Document Manager plugin <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update vulnerability
Authenticated Subscriber+ Arbitrary Folder Name Update vulnerability discovered by fewwords huang in WordPress Plugin SP Project & Document Manager versions = 4.70...
CVE-2020-26312
Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target...
Arbitrary File Read
github.com/dotmesh-io/dotmesh is vulnerable to Arbitrary File Read. The vulnerability is due to the unsafe handling of symbolic links in an unpacking routine, allowing attackers to read and/or write to arbitrary locations outside the designated target folder...
May 14, 2024—KB5037782 (OS Build 20348.2461)
None None...
Veritas System Recovery 安全漏洞
Veritas System Recovery is a fast, easy-to-use backup and recovery solution for Microsoft Windows servers from Veritas USA. A security vulnerability exists in versions prior to Veritas System Recovery 23.2Hotfix that stems from incorrect permissions on the Veritas System Recovery folder...
General Electric Healthcare Ultrasound 路径遍历漏洞
GE General Electric Healthcare Ultrasound is a medical sonic detection device from General Electric GE. A path traversal vulnerability exists in General Electric Healthcare Ultrasound. An attacker could exploit this vulnerability to access files and directories stored outside of the web root fold...
Local privilege escalation due to insecure folder permissions
...
Public Folder Backup Hangs
Challenge An Exchange backup job that contains a public folder mailbox runs in an endless cycle, continuously getting changed items from one of the public folders. In the job logs, you can see multiple entries in the following format: Changed items: 0, deleted items: 0, read state changes: 100...
PT-2024-3953 · Veritas · Veritas System Recovery
Name of the Vulnerable Software and Affected Versions: Veritas System Recovery versions prior to 23.3 Hotfix Description: The issue is related to incorrect permissions for the Veritas System Recovery folder, allowing low-privileged users to conduct attacks. Exploitation of this issue may enable a...
CVE-2024-1693 SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdmsavecategory AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2024-1076
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who...
CVE-2024-1076: Missing Authentication for Critical Function
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who...
