19132 matches found
Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the uploadFile method. The issue...
Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the saveInlineEdit method. The issue...
Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the uploadSimpleFile method. The iss...
Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the serveMathJaxLibraries method. The issue results from the lack of proper validation o...
Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the unzipFile method. The issue...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an illegal authorization vulnerability that stems from the Jira plugin's inability to check the security level of incoming issues when processing subscriptions and to restrict...
Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a registration mechanism that can be used to create a new user with a sufficient privilege...
Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadExportedChart action. The issue results from the lack of proper validation of a...
Epik, the Far Right's Favorite Web Host, Has a Shadowy New Owner
Known for doing business with far-right extremist websites, Epik has been acquired by a company that specializes in helping businesses keep their operations secret...
Vulnerabilities fixed in VMware Aria Operations Networks
VMWare has fixed vulnerabilities in Aria Operations Networks, formerly known as vRealize Network Insight. A malicious party could exploit the vulnerabilities to gain access to sensitive data, to elevate privileges or to launch a Cross-Site Scripting XSS attack. The vulnerability marked...
VMWare Aria Operations for Networks 6.x < 6.12 Multiple Vulnerabilities (VMSA-2024-0002)
According to its self-reported version, the instance of VMWare Aria Operations for Networks running on the remote web server is 6.x 6.12.0.1706185032. It is, therefore, affected by multiple vulnerabilities: - Aria Operations for Networks contains a local privilege escalation vulnerability. A...
PT-2024-1746 · Fortinet · Forticlientems
Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientEMS versions 7.2.0 through 7.2.2 Fortinet FortiClientEMS versions before 7.0.10 Description: The issue is related to improper privilege management, allowing a Site administrator with Super Admin privileges to perform globa...
USN-6624-1: Linux kernel vulnerabilities
Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service paravirtualized device unavailability. CVE-2023-34324 Zheng Wang discovered...
Security Bulletin: IBM Datapower Operations Dashboard to a denial of service caused by an unsafe deserialization flaw
Summary Apache Johnzon is used by the IBM Datapower Operations Dashboard in its JSON processing. Vulnerability Details CVEID:CVE-2023-33008 DESCRIPTION: Apache Johnzon is vulnerable to a denial of service, caused by an unsafe deserialization flaw in BigDecimal. By sending a specially crafted JSON...
kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt
A vulnerability was found in the tcp subsystem in the Linux Kernel, due to a data race around icsk-icskafops. This issue could allow an attacker to leak internal kernel information...
Security Bulletin: Datapower Operations Dashboard Multiple Vulnerabilities in Apache Tomcat
Summary IBM has addressed the CVEs Vulnerability Details CVEID:CVE-2023-45648 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP trailer headers. By sending a specially crafted invalid trailer header, an attacker could exploit this vulnerability...
VMware Releases Security Advisory for Aria Operations for Networks
VMware released a security advisory to address multiple vulnerabilities in Aria Operations for Networks. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware security advisory...
Cisco Expressway Series 跨站请求伪造漏洞
Cisco Expressway Series is an American Cisco software for accessing devices outside the firewall. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to perform arbitrary operations...
The vulnerability of the network and application monitoring tool in VMware Aria Operations for Networks, due to deficiencies in access control, allows a malicious actor to elevate their privileges to the root user level.
The vulnerability of the network and application monitoring tool in VMware Aria Operations for Networks is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to elevate their privileges to the level of a root user...
