PT-2022-11771 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 6.2.1 and below FortiADC versions 6.1.5 and below FortiADC versions 6.0.4 and below FortiADC versions 5.4.5 and below FortiADC versions 5.3.7 and below Description: An improper privilege management issue may allow a remote...

FortiADC -- Read-Only user able to modify system files

An improper privilege management vulnerability CWE-269 in FortiADC may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access...

PublicCMS server-side request forgery vulnerability

PublicCMS is an open source content management system CMS written in Java by PublicCMS, China. publicCMS 4.0.202011.b previous versions exist server-side request forgery vulnerability, the vulnerability stems from the file parameter for access to the IP and domain name is not restricted. An...

Dell Container Storage Modules Path Traversal Vulnerability

Dell Container Storage Modules is a set of modules from Dell, Inc. Dell Container Storage Modules version 1.2 contains a path traversal vulnerability that could be exploited by a remote authenticated attacker with low privileges to cause unintentional access to paths outside of restricted...

Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing

The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations in certain situations. PoC Set HTTPCFCONNECTINGIP or any of the other headers in getclientipaddress to spoof the IP address...

The vulnerability of microprogrammed network device software from Zyxel models USG FLEX 100(W), USG FLEX 200, USG FLEX 500, USG FLEX 700, USG FLEX 50(W), USG20(W)-VPN, ATP, VPN, USG/ZyWALL arises due to incorrect path name restrictions in the access-controlled catalog. This allows attackers to disclose sensitive information.

The vulnerability of microprogrammed network devices such as Zyxel USG FLEX 100W, USG FLEX 200, USG FLEX 500, USG FLEX 700, USG FLEX 50W, USG20W-VPN, ATP, VPN, USG/ZyWALL exists due to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability can allow a...

Path traversal

Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to unintentional access to path outside of restricted directory...

PT-2022-23853 · Msys2 · Msys2

Name of the Vulnerable Software and Affected Versions: Msys2 versions v20220603 and below Description: The issue is related to incorrect access control in the install directory of Msys2, specifically C:msys64, which allows authenticated attackers to execute arbitrary code by overwriting binaries...

Dell Container Storage Modules 路径遍历漏洞

Dell Container Storage Modules is a set of modules from Dell, Inc. Dell Container Storage Modules version 1.2 contains a path traversal vulnerability that could be exploited by a remote authenticated attacker with low privileges to cause unintentional access to paths outside of restricted...

The vulnerability of the /ptippage.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming system allows a intruder to gain full access to the device.

The vulnerability of the /ptippage.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming system is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain ful...

CVE-2022-34368: Improper Handling of Insufficient Permissions or Privileges

Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non admin user could exploit this vulnerability and gain access to restricted resources...

Ubuntu: Security Advisory (USN-377-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-346-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the software for designing and configuring Connected Components Workbench controllers arises from incorrect restrictions on the path to the restricted-access directory. This allows attackers to escalate their privileges.

The vulnerability of the software for designing and configuring Connected Components Workbench controllers is related to incorrect path name restrictions in the restricted access catalog during file syntax analysis. Exploiting this vulnerability can allow attackers to increase their privileges...

Design/Logic Flaw

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentialit...

PT-2022-23829 · D Link · Dir-816

Name of the Vulnerable Software and Affected Versions: D-link DIR-816 version 1.10CNB04 Description: The issue allows the router to reboot without authentication via the "/goform/doReboot" API endpoint. No authentication is required, and the reboot is executed when the function returns at the end...

The vulnerability of the Proficy Machine Edition programming software for programmable logic controllers arises from incorrect restrictions on the path name to the restricted access directory. This allows a perpetrator to execute arbitrary code.

The vulnerability of the Proficy Machine Edition programming software is related to incorrect restrictions on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted .BLZ file...

Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2022-2218)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-FX9G-G9Q6-X3JX Magento Path Traversal vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

Debian: Security Advisory (DSA-5207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...