120 matches found
Open Redirect
kibana is vulnerable to open redirect. The vulnerability exists due to flawed router path checks which allows an attacker to redirect the user to an arbitrary website...
USN-5734-1 freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain data lenghts. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu...
Connected Components Workbench Path Traversal Privilege Escalation
The vulnerability of the software for designing and configuring Connected Components Workbench controllers is related to incorrect path name restrictions in the restricted access catalog during file syntax analysis. Exploiting this vulnerability can allow attackers to increase their privileges...
CVE-2022-36908
A cross-site request forgery CSRF vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an...
Apache Hadoop unTar Arbitrary File Write
The vulnerability of the unTar function implementation in the distributed development and execution platform for Apache Hadoop is related to deficiencies in checking the path name of the restricted-access directory. Exploiting this vulnerability could allow an attacker to write arbitrary files...
Cisco IOS XE Software backend link vulnerability
Cisco IOS XE Software is an operating system from Cisco, Inc. A single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity. Cisco IOS XE suffers from a backlink vulnerability that stems from not performing actu...
CVE-2022-24309
A vulnerability has been identified in Mendix Runtime V7 All versions V7.23.29, Mendix Runtime V8 All versions V8.18.16, Mendix Runtime V9 All versions V9.13 only with Runtime Custom Setting DataStorage.UseNewQueryHandler set to False. If an entity has an association readable by the user, then in...
reg.exe Command Execution
The vulnerability of the command-line utility reg.exe, a tool for development and automatic updates of VMware InstallBuilder installer for Windows operating systems, is related to errors in the mechanism for checking pathfinding for dynamically linked libraries. Exploiting this vulnerability coul...
CURL Configuration Comparison Name Reference Confidential Data Access
The vulnerability of the configuration comparison function of the software tool for interacting with servers via CURL is related to the comparison of paths without considering registrations. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...
CVE-2021-37105
There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal...
PT-2021-7453
Name of the Vulnerable Software and Affected Versions Moxa MXView affected versions not specified Description The issue is related to insufficient checks on the directory path name with limited access in Moxa MXView network control software. Exploitation of this issue may allow a remote attacker ...
CURL-CVE-2021-22924 Bad connection reuse due to flawed path name checks
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could...
FortiMail Webmail Unauthorized Access
The vulnerability of FortiMail’s webmail system relates to deficiencies in the checking of path names to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through specially crafted web requests...
Magento Commerce Path Traversal
The vulnerability of the Magento Commerce development and management software platform is related to incorrect restrictions on the path name used to access the restricted catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system...
UniFiVideo Code Execution
The vulnerability of the UniFiVideo.exe executable file of the Ubiquiti UniFi Video surveillance device software is related to errors in the mechanism for checking pathfinding for dynamically attached libraries. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Kaspersky Endpoint Security Web Antivirus Data Compromise
The vulnerability of the Web Antivirus component of Kaspersky Endpoint Security relates to insufficient checking of file paths for reparse points. Exploiting this vulnerability can allow attackers to compromise data integrity...
Flask-CORS Resource Division
The vulnerability of the CORS source handling mechanism for resource division involves incorrect checking of the path name. Exploiting this vulnerability could allow an attacker, operating remotely, to access confidential data...
NVIDIA Control Panel Driver Privilege Escalation
The vulnerability of the NVIDIA Control Panel driver for graphics processors such as NVIDIA GeForce, Quadro, NVS, and Tesla for Windows operating systems is related to errors in checking the path where dynamically loaded libraries are loaded. Exploiting this vulnerability can allow an attacker to...
USN-4616-2: AccountsService vulnerabilities
USN-4616-1 fixed several vulnerabilities in AccountsService. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cause...
USN-4616-2 accountsservice vulnerabilities
USN-4616-1 fixed several vulnerabilities in AccountsService. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cause...