PT-2023-29857

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides web application is vulnerable to a Server-Side Request Forgery SSRF attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing...

8x8: Unprotected Atlantis Server at https://152.70.█.█

The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...

CVE-2023-43066

Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands...

Design/Logic Flaw

Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands...

CVE-2023-43066

Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands...

CVE-2023-43066

Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands...

CVE-2023-43066

Dell Unity CVE-2023-43066 affects versions prior to 5.3. This is a Restricted Shell Bypass vulnerability that enables an authenticated, local attacker to exploit by logging into the device CLI and issuing certain commands. Impact is described as high for confidentiality, integrity, and availabili...

CVE-2023-43066: Improper Neutralization of Special Elements used in an OS Command

Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands...

PT-2023-28677 · Dell · Dell Unity

Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.3 Description: The issue allows an authenticated, local attacker to exploit a Restricted Shell Bypass vulnerability by authenticating to the device CLI and issuing certain commands. Recommendations: For versions...

Malicious sub-account operators can perform cross-chain signature replay attack

Lines of code Vulnerability details Impact Malicious sub-account operators can perform policy or transactions not allowed to the specific chain but allowed in other chain. This is possible due to cross-chain signature replay attack. Proof of Concept To describe the attack, for example, let us hav...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper restriction on the path name to the restricted directory. This allows attackers to write files to any location within the file system.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write files to any location within the file system...

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in the improper limitation of the path name for the restricted access directory. This allows a perpetrator to obtain an arbitrary file size from the file system.

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain an arbitrary file size from the file system using the FTP SIZ...

CVE-2023-43801: Improper Limitation of a Pathname to a Restricted Directory

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass t...

The vulnerability of the Suricata intrusion detection and prevention system arises from an improper limitation on the path name to the restricted access catalog. This allows intruders to write arbitrary files into the file system.

The vulnerability of the Suricata intrusion detection and prevention system lies in the incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files into the file system...

The vulnerability lies in the implementation of OPC UA software methods for connection integration with the Softing OPC UA C++ SDK, as well as the Secure Integration Server data integration tool. This allows attackers to execute arbitrary code.

The vulnerability of the implementation of OPC UA software for connectivity integration with Softing OPC UA C++ SDK lies in the incorrect path name limitation for accessing the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-38280

IBM HMC Hardware Management Console 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740...

Code injection

IBM HMC Hardware Management Console 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740...

CVE-2023-38280: Improper Privilege Management

IBM HMC Hardware Management Console 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 260740...

The vulnerability of the Avalanche device management system, related to incorrect restrictions on the path name to the restricted access catalog, allows a hacker to execute arbitrary code.

The vulnerability of the Avalanche device management system is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the FortiSandbox threat detection and mitigation system lies in its improper handling of path name restrictions for restricted access directories. This allows attackers to trigger a service failure.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...