Internet Bug Bounty: Improper handling of wildcards in --allow-fs-read and --allow-fs-write

The Node.js Permission Model was found to have improper handling of wildcards in the --allow-fs-read and --allow-fs-write options. The implementation silently ignored any text after a wildcard character, potentially granting unintended file system access. Additionally, when the wildcard character...

PT-2024-2369 · Automationdirect · Automationdirect C-More Ea9 Hmi

Name of the Vulnerable Software and Affected Versions: AutomationDirect C-MORE EA9 HMI affected versions not specified Description: The issue is related to a function in the AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the...

CVE-2024-29650

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components...

CVE-2024-29650

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components...

Thi.ng Paths security vulnerabilities

thi.ng paths is a path-based object property/array accessor with struct-shared immutable, optimized and optional types. A security vulnerability exists in thi.ng paths version v.5.1.62 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary code via the mutIn and...

CVE-2024-29650

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components...

CVE-2024-29650: Improperly Controlled Modification of Object Prototype Attributes

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components...

CVE-2024-29650

An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components...

PT-2024-22950

Name of the Vulnerable Software and Affected Versions @thi.ng/paths versions 5.1.62 and earlier Description An issue in the software allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. This enables the attacker to perform unauthorized actions on the...

@-0/browser (>=0.3.1, <=0.3.61), @cfxjs/extension-runtime (>=0.0.1, <=0.0.4) +41 more potentially affected by CVE-2024-29650 via @thi.ng/paths (>=1.6.6, <=4.2.14)

@thi.ng/paths NPM version =1.6.6, =0.3.1, =0.0.1, =0.0.2, =0.0.1, =0.2.0, =0.2.0, =0.0.4, =0.0.3, =0.0.13, =0.0.1, =1.0.5, =0.0.1, =0.3.0, =0.3.2 and more Source cves: CVE-2024-29650 Source advisory: MEND:CVE-2024-29650...

PT-2024-14126 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.4 and 2.24.1 Description: An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the "REST Coverage Store API" to upload...

emacs: command injection vulnerability in htmlfontify.el

A flaw was found in the Emacs package. If a file name or directory name contains shell metacharacters, arbitrary code may be executed...

CVE-2024-2635

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

CVE-2024-2635 Multiple vulnerabilities on Meta4 HR from Cegid

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

CVE-2024-2635 Multiple vulnerabilities on Meta4 HR from Cegid

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they d...

PT-2024-21364

Name of the Vulnerable Software and Affected Versions Cegid Meta4 HR affected versions not specified Description The configuration pages in Cegid Meta4 HR are not intended to be placed on an Internet-facing web server, as they expose file paths to the client, who can be an attacker. These pages d...

DEBIAN-CVE-2024-23333

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When th...

CVE-2024-23333

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When th...

PT-2024-19815

Name of the Vulnerable Software and Affected Versions LDAP Account Manager LAM versions prior to 8.7 Description LDAP Account Manager LAM is a web frontend for managing entries stored in an LDAP directory. LAM's log configuration allows specifying arbitrary paths for log files. An attacker could...

CVE-2024-2193

A Speculative Race Condition SRC vulnerability that impacts modern CPU architectures supporting speculative execution related to Spectre V1 has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the...