CVE-2023-32985: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability due to a privilege bypass in AdminRestrictedPermissionsUtils.java's onSetRuntimePermissionGrantStateByDeviceAdmin, which can be exploited by an attacker to obtain...

distribution catalog API endpoint can lead to OOM via malicious user input

Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code...

GHSA-HQXW-F8MX-CPMW distribution catalog API endpoint can lead to OOM via malicious user input

Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code...

CVE-2023-31166 Improper Limitation of a Pathname to a Restricted Directory

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system. See...

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway (SDG) allows a intruder to execute arbitrary code.

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway SDG is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2023-31404

Under certain conditions, SAP BusinessObjects Business Intelligence Platform Central Management Service - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could...

CVE-2023-31404

Under certain conditions, SAP BusinessObjects Business Intelligence Platform Central Management Service - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could...

CVE-2023-30740

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact on integrity and availability of the...

CVE-2023-31404 Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)

Under certain conditions, SAP BusinessObjects Business Intelligence Platform Central Management Service - versions 420, 430, allows an attacker to access information which would otherwise be restricted. Some users with specific privileges could have access to credentials of other users. It could...

DHIS 2 安全漏洞

DHIS 2 is a software application. A flexible information system for data capture, management, validation, analysis and visualization. A security vulnerability exists in DHIS 2 Core versions prior to 2.36.13, prior to 2.37.8, and prior to 2.38.2, which stems from the fact that users may be able to...

PT-2023-23299 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Service versions 420, 430 Description: The issue allows an attacker to access restricted information under certain conditions. Some users with specific privileges could hav...

CVE-2017-20184

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device...

PT-2023-22815 · Unknown · Tuleap Open Alm

Name of the Vulnerable Software and Affected Versions: Tuleap Open ALM versions prior to 14.7.99.143 Description: The title of an artifact is not properly escaped in the tooltip, allowing a malicious user with the capability to create an artifact or edit a field title to force a victim to execute...

CVE-2023-28406

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...

Directory traversal

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from the possibility th...

GitLab 12.0 < 15.10.5 / 15.11 < 15.11.1 (CVE-2023-1621)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to...

OESA-2023-1267 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free flaw was found in ndlcremove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.CVE-2023-1990 The Linux kernel before 6.2.9 has a race...

PT-2023-18968 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the system, affecting the file /admin/inquiries/view inquiry.php. The manipulation of the id argument leads to SQL injection. This...