Exploit for External Control of File Name or Path in Moodle

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...

Citrix ShareFile StorageZones file upload

Added: 08/28/2023 Background ShareFile is a file sharing service. StorageZones are user-maintained storage for ShareFile data. Problem A vulnerability in ShareFile StorageZones Controller allows remote attackers to upload arbitrary files, leading to command execution. Resolution Upgrade to...

Citrix ShareFile StorageZones file upload

Added: 08/28/2023 Background ShareFile is a file sharing service. StorageZones are user-maintained storage for ShareFile data. Problem A vulnerability in ShareFile StorageZones Controller allows remote attackers to upload arbitrary files, leading to command execution. Resolution Upgrade to...

PT-2023-27494 · Lg · Lg Simple Editor

Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of LG Simple Editor. To exploit this, an attacker must first obtain the ability to execute...

CVE-2023-38831

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the...

CVE-2023-38831: Insufficient Verification of Data Authenticity

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file such as an ordinary .JPG file and also a folder that has the same name as the benign file, and the...

PT-2023-9228 · Trend Micro · Trend Micro Apex One

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One affected versions not specified Description: An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. The vulnerability is related to...

DoorGets CMS 12 Information Disclosure

==================================================================================================================================== | Title : DoorGets CMS v12 Sensitive information disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firef...

Inosoft VisiWin 安全漏洞

Inosoft VisiWin is a software platform for human machine interface HMI and process data visualization from Inosoft Corporation. A security vulnerability exists in Inosoft VisiWin version 7 2022-2.1 that originates from the creation of an insecure folder during installation, which could allow a...

Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Vulnerability

Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Privilege Escalation Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://www.inosoft.com/ Version: Up to 2022-2.1 Runtime RT7.3 RC3 20221209.5 Tested on: Windows CVE: CVE-2023-31468 Inoso...

TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions

Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.2.14 Tested on: Windows CVE : CVE-2023-31067 TSplus Remote Access v...

Information Disclosure

org.jenkins-ci.plugins, cloudbees-folder is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly restrict the organization folder log file location, which allows an attacker to gain access to sensitive information in the system...

Cross-Site Request Forgery (CSRF)

gin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability occurs because the plugin does not require POST requests for an HTTP endpoint, which allows allows an attacker to copy a malicious folder, which could then be used to steal data or execute arbitrary code...

CVE-2023-40338

A flaw was found in the Jenkins Folders plugin. Affected versions of this plugin display an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available. This flaw exposes information about the Jenkins controller fi...

CVE-2023-40336

A flaw was found in the Jenkins Folders Plugin. Affected versions of this plugin allow attackers to copy folders...

org.jenkins-ci.plugins.workflow:workflow-multibranch (>=2.1, <=2.4), org.jenkins-ci.plugins:github-organization-folder (>=1.3, <=1.4) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.8)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch =2.1, =1.3, =1.4 Source cves:...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.0-b24) +12 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.17)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =1.0.0-b22...

org.jenkins-ci.plugins:global-build-stats (>=1.4, <=1.5) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.9)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:global-build-stats =1.4, =1.5 Source cves: CVE-2023-40337...

org.jenkins-ci.plugins.workflow:workflow-multibranch (2.10-beta-1), org.jenkins-ci.plugins:branch-api (2.0.0-beta-1) +2 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.15)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-multibranch 2.10-beta-1 -...

io.fabric8.jenkins.plugins:openshift-sync (>=0.9.1, <=1.0.30), io.jenkins.blueocean:blueocean (1.0.0-b25) +12 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (5.18)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.9.1, =2.15, =1.0, =1.7.6, =1.8.15...