CVE-2021-21692

FilePathrenameTo and FilePathmoveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'...

CVE-2021-26610

The moveuploadedfile function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code...

PT-2021-17077

Name of the Vulnerable Software and Affected Versions godomall5 affected versions not specified Description The issue arises from the move uploaded file function in godomall5, which fails to perform an integrity check of file extensions or authority when users upload files. This allows an attacke...

CVE-2021-36097

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions...

CVE-2021-39886

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references...

CVE-2021-39886: Incorrect Default Permissions

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references...

GitLab 权限许可和访问控制问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab suffers from a Permission Permission and Access...

CVE-2021-41324

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...

Directory traversal

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal files or Cells files belonging to any user via the nodes parameter for Copy and Move or via the Path parameter for Delete...

Abstrium Pydio Cells 路径遍历漏洞

Abstrium Pydio Cells is a next-generation file sharing platform developed using the Go language by Abstrium France. A path traversal vulnerability exists in Abstrium Pydio Cells 2.2.9, which allows a remote authenticated user to pass the node parameter for copy and move or pass the path parameter...

DRUPAL-CONTRIB-2021-035

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing a...

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing a...

PT-2021-31135

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing a...

PT-2021-27757

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow READ 8 crash type. The crash state involves functions such as value move, mrb ary splice, and mrb ary aset. ...

DEBIAN-CVE-2021-39254

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfsattrrecordresize, in NTFS-3G 2021.8.22...

Unbreakable Enterprise kernel security update

4.14.35-2047.506.10 - Revert 'rds/ib: reap tx completions during connection shutdown' Manjunath Patil Orabug: 33220435 - Revert 'rds/ib: handle posted ACK during connection shutdown' Manjunath Patil Orabug: 33220435 - Revert 'rds/ib: recover rds connection from interrupt loss scenario' Manjunath...

CVE-2020-20979

An arbitrary file upload vulnerability in the moveuploadedfile function of LJCMS v4.3 allows attackers to execute arbitrary code...

PT-2021-10565

Name of the Vulnerable Software and Affected Versions: LJCMS version 4.3 Description: The issue is related to an arbitrary file upload vulnerability in the move uploaded file function, which allows attackers to execute arbitrary code. Recommendations: For LJCMS version 4.3, consider disabling the...

LJCMS 代码问题漏洞

Ljcmsshop is a Php-based online shopping mall building system developed by China's Ljcms. LJCMS has a security vulnerability , the vulnerability stems from the move upload file function of the arbitrary file upload vulnerability allows an attacker to exploit the vulnerability to execute arbitrary...

OPENSUSE-SU-2021:2136-1 Security update for cryptctl

This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage bsc1186226 - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organizati...