User with system administrator privilege can search restricted pages.

h3. Issue Summary Starting Confluence 8.5.1 when a user is granted System administrator permission at Global permissions. The user can search for Restricted content and the restricted page gets displayed in search, when tried to access it says "Page can't be found". This behaviour is not...

PT-2023-28981 · Cadence · Cadence

Name of the Vulnerable Software and Affected Versions: Cadence versions through 0.9.2 2023-08-21 Description: The issue arises from Cadence using an insecure temporary file /tmp/cadence-wineasio.reg. If a local adversary creates this file before Cadence starts, Cadence will use it, allowing the...

As a sys admin user without permissions to view a restricted space, I can see activity for it but cannot view the space or pages in it

h3. Issue Summary This is reproducible on Data Center: YES. h3. Steps to Reproduce h4. Steps on Bulldog: Sign in as a user with all of these permissions: Can Use, Personal Space, Create Spaces, Confluence Administrator optional, System Administrator. Note that this use should not be present in th...

A vulnerability exists in the MAGLINK LX Web Console, a web-based console for managing fuel tanks. This vulnerability stems from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain access to files within the system.

The vulnerability of the MAGLINK LX Web Console, which manages fuel tanks, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain access to system files remotely...

CVE-2021-28485

In Ericsson Mobile Switching Center Server MSC-S before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system that are not intended to be accessible via the web application...

CVE-2023-37739: Improper Limitation of a Pathname to a Restricted Directory

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-40309

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40309

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

Authorization

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40309 Missing Authorization check in SAP CommonCryptoLib

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-40309 Missing Authorization check in SAP CommonCryptoLib

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionalit...

CVE-2023-25519

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful exploit of this vulnerability may lead to escalation of privileges...

NVIDIA ConnectX Security Vulnerability

NVIDIA ConnectX is a series of intelligent network interface cards from NVIDIA Corporation. A security vulnerability exists in NVIDIA ConnectX that originates from a restricted host may result in an incorrect user management error that could lead to privilege escalation...

The vulnerability of the XInclude mechanism for combining XML documents in the librsvg visualization library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the XInclude mechanism for combining XML documents in the librsvg vector graphics rendering library is related to an incorrect restriction on the path name to the restricted directory during the processing of the xi:include element. Exploiting this vulnerability could allow a...

The vulnerability of the Fusion File Manager component in the PHP-Fusion CMS system allows a hacker to gain access to read and modify files.

The vulnerability of the Fusion File Manager CMS system’s PHP-Fusion component is related to an incorrect limitation on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to gain access to and modify files through a specially created HTTP request...

Apache Superset 安全漏洞

Apache Superset is a Python language based development of open source fashionable data exploration and analysis and visualization of the reporting platform , support for rich data sources , and has a colorful visualization of the charts to choose from . An unauthorized access vulnerability exists...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions have an authorization issue vulnerability that stems from incorrect authorization checks in SQLLab. An attacker can exploit the vulnerability to...

PT-2023-28177 · Jenkins · Jenkins Ssh2 Easy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SSH2 Easy Plugin versions 1.4 and earlier Description: The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage...

PT-2023-23735 · Ibm · Ibm Sterling Secure Proxy +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy and IBM Sterling External Authentication Server versions 6.0.3 through 6.1.0 Description: The issue allows a local user with container access to read user credentials stored in plain clear text. Recommendations: For...

PT-2023-30323 · Unknown · Xintian Smart Table Integrated Management System

Name of the Vulnerable Software and Affected Versions: Xintian Smart Table Integrated Management System version 5.6.9 Description: A critical issue was found in the Xintian Smart Table Integrated Management System. This issue affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The...