CVE-2022-25848

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory...

Concrete CMS 9.1.3 XPATH Injection

Title: concretecms-9.1.3 Xpath injection Author: nu11secur1ty Date: 11.28.2022 Vendor: https://www.concretecms.org/ Software: https://www.concretecms.org/download Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3 Description: The...

CVE-2022-41158

Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...

PT-2022-25687 · Eyoom Co. +1 · Eyoom Builder

Name of the Vulnerable Software and Affected Versions: Builder program affected versions not specified Description: The issue allows for remote code execution by utilizing cookie values as paths to a file. This can be exploited by a remote attacker to execute or inject malicious code...

CVE-2022-41158 eyoom builder Remote Code Execution Vulnerability

Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...

OPENSUSE-SU-2022:10212-1 Security update for xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...

PT-2022-37625 · Opensuse +3 · Xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...

The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to send incorrect values to parameters, receive error messages, or obtain debugging information regarding installatio...

Buildah 路径遍历漏洞

Bulidah is an open source, Linux-based tool from Containers open source. It is used to build containers that are compatible with the Open Container Initiative OCI.Containers Buildah suffers from a security vulnerability. An attacker could exploit the vulnerability to cause local path and...

Wiz becomes the first CNAPP to deliver integrated Data Security Posture Management

Wiz expands its platform to proactively eliminate attack paths to discovered critical data...

Studio42 elFinder Directory Traversal (CVE-2022-26960)

A directory traversal vulnerability exists in elFinder. The vulnerability is due to insufficient validation of user submitted paths...

Webvendome 路径遍历漏洞

Webvendome is an application from Webvendome, Inc. Webvendome suffers from a path traversal vulnerability that stems from an internal server IP and full path disclosure, which can be exploited by an attacker to send GET requests...

GSD-2022-1006911 net: thunderbolt: Enable DMA paths only after rings are enabled

net: thunderbolt: Enable DMA paths only after rings are enabled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-35166 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the thunderbolt net functionality in the Linux Kernel, where DMA paths are enabled before rings are enabled. This could potentially lead to security vulnerabilities,...

openSUSE openldap2代码问题漏洞

openSUSE openldap2 is a Lightweight Directory Access Protocol v3 LDAPv3 client and server reference implementation from SUSE Germany. The server provides several database backends and overlays. A code issue vulnerability exists in openSUSE openldap2 versions prior to 2.3.6 through 404.1, which...

PT-2022-26842 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 11.2.118.51569 Description: The issue allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute path. This is due to an uncontrolled search path element in Foxit Software's...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

Arbitrary File Write

apache ivy is vulnerable to arbitrary file write. The vulnerability exists due to the unpack function in ZipPacking.java not properly verifying the target path when extracting an artifact archive, allowing an attacker to write files to any location on the file system through the absolute paths or...

GHSA-94RR-4JR5-9H2P Apache Ivy does not verify target path when extracting the archive

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the...

Apache Ivy does not verify target path when extracting the archive

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the...