7433 matches found
Incorrect context paths included in the fallback URL still pass you to the login form when enable-authentication-fallback is enabled.
h3. Issue Summary When using an incorrect fallback URL to bypass SAML, you are still passed to the login form. This can be reproduced using a context path in the URL when no context path is set in the server.xml or by using a misspelled/wrong context path when one is set. This is reproducible on...
Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
A flaw was found in the Apache Zookeeper package. Affected versions of this package are vulnerable to Information Exposure due to a missing ACL check in the handling of persistent watchers. An attacker can monitor child znodes by attaching a persistent watcher addWatch command to a parent node th...
PT-2024-6251 · Microsoft · Windows Setup/Deployment +1
Name of the Vulnerable Software and Affected Versions: Windows Setup and Deployment affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Windows Setup and Deployment component. It is associated with a lack of quotes in writing element...
ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
A flaw was found in Ghostscript. When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix "foo" and "./foo". This does not take into account paths...
Moderate: Red Hat Security Advisory: ghostscript security update
An update for ghostscript is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
gix-path improperly resolves configuration path reported by Git
Summary gix-path runs git to find the path of a configuration file associated with the git installation, but improperly resolves paths containing unusual or non-ASCII characters, in rare cases enabling a local attacker to inject configuration leading to code execution. Details In gixpath::env, th...
PT-2024-31609 · Gix-Path +2 · Gix-Path +2
Name of the Vulnerable Software and Affected Versions: gix-path versions prior to 0.10.11 Description: The issue concerns the improper resolution of paths containing unusual or non-ASCII characters by gix-path, which can enable a local attacker to inject configuration leading to code execution in...
PT-2024-31605 · Stripe · Stripe Cli
Name of the Vulnerable Software and Affected Versions: stripe-cli versions 1.11.1 through 1.21.2 Description: A path traversal vulnerability exists in stripe-cli where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flag...
CVE-2024-44952
In the Linux kernel, the following vulnerability has been resolved: driver core: Fix ueventshow vs driver detach race ueventshow wants to de-reference dev-driver-name. There is no clean way for a device attribute to de-reference dev-driver unless that attribute is defined via struct...
Cisco Meraki Systems Manager Agent for Windows Privilege Escalation Vulnerability
A vulnerability in Cisco Meraki Systems Manager SM Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this...
PT-2024-9565 · Veeam · Veeam Backup & Replication
Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation. The issue is related...
PT-2024-5916
Name of the Vulnerable Software and Affected Versions Cisco Meraki Systems Manager SM Agent for Windows affected versions not specified Description A vulnerability in Cisco Meraki Systems Manager SM Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with...
AlmaLinux 9 : ghostscript (ALSA-2024:6197)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6197 advisory. ghostscript: format string injection leads to shell command execution SAFER bypass CVE-2024-29510 ghostscript: path traversal and command execution due to...
ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
A flaw was found in Ghostscript. When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix "foo" and "./foo". This does not take into account paths...
Moderate: Red Hat Security Advisory: ghostscript security update
An update for ghostscript is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
ALSA-2024:6197 Moderate: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: format string injection leads to shell command execution SAFER bypass...
VulnCheck KEV: CVE-2024-6473
Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used...
CVE-2024-45305 gix-path uses local config across repos when it is the highest scope
gix-path is a crate of the gitoxide project dealing with git paths and their conversions. gix-path executes git to find the path of a configuration file that belongs to the git installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped...
Hitachi Device Manager Quotation Injection
The vulnerability of the Hitachi Device Manager storage management system is related to the absence of quotation marks in the wording of elements or search paths. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected...
Apache Flink JobManager Traversal
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink JobManager Traversal', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Flink...