9312 matches found
PT-2023-2616 · Myscada · Myscada Mypro
Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions 8.26.0 and prior Description: The issue is related to insufficient checking of arguments passed to a command, allowing a remote attacker to execute arbitrary code in the operating system. An authenticated user could...
UBUNTU-CVE-2022-25277
Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference: SA-CORE-2019-010. However, the protections for these two vulnerabilities previously did...
Security Advisory - Identity Authentication Bypass Vulnerability in Huawei HiLink AI Life Product
Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.Vulnerability ID:HWPSIRT-2022-42291 This vulnerability has been assigned a CVEID:CVE-2022-48470...
The vulnerability of the FTP service for operating system network storage devices like My Cloud OS allows a hacker to gain full access to the device and execute arbitrary code.
The vulnerability of the FTP service in operating system network storage devices like My Cloud OS is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow an attacker to gain full access to the device and execute arbitrary code...
Discourse 3.1.x < 3.1.0.beta2 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...
GHSA-X37V-36WV-6V6H Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Impact The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricte...
PT-2023-8608 · Xwiki · Xwiki
Name of the Vulnerable Software and Affected Versions: XWiki versions 4.2-milestone-1 through 14.10 Description: The issue concerns the "restricted" mode of the HTML cleaner in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. This...
The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers arises from incorrect restrictions on the path name in the restricted access catalog. This allows attackers to trigger a service failure.
The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers is related to an incorrect limitation on the path name in the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...
The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived allows a attacker to gain unauthorized access to protected information.
The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...
CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...
FANUC ROBOGUIDE-HandlingPRO
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: FANUC Equipment: ROBOGUIDE-HandlingPRO Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to read and/or overwrite files on the system running the affected...
PT-2023-2788 · Oracle +2 · Virtualbox +2
Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.44 Oracle VM VirtualBox versions prior to 7.0.8 Description: The issue is related to a use-after-free vulnerability in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker...
Users can set up workflows using restricted and invisible system tags
None...
CVE-2023-1109: Improper Limitation of a Pathname to a Restricted Directory
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the...
PT-2025-54258
Name of the Vulnerable Software and Affected Versions Anevia Flamingo XL version 3.2.9 Description A flaw exists in Anevia Flamingo XL 3.2.9 that allows remote attackers to bypass the sandboxed environment using the traceroute command. Exploitation of the traceroute command enables attackers to...
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the incorrect restriction on the path to the restricted-access catalog, which allows attackers to gain unauthorized access to protected information.
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access catalog, allowing attackers to read arbitrary files.
The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files using a specially created HTTP request...
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the incorrect restriction on the path to the restricted-access catalog, which allows attackers to gain unauthorized access to protected information.
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
