GHSA-WX5H-WQFQ-V698 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available...

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available...

GHSA-6FFG-MJG7-585X Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Impact An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. Patches Will be patched in 14.3.3 and 15.2.3. Workarounds None available...

CVE-2025-25267

A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized...

CVE-2025-27430

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA Interaction Center allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's...

CVE-2025-27430 Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA Interaction Center allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's...

CVE-2025-27430 Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)

Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA Interaction Center allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's...

CVE-2025-27430

SAP CRM and SAP S/4HANA (Interaction Center) are affected by a server-side request forgery (SSRF) vulnerability. The vulnerability allows an attacker with low privileges to access internal network resources, compromising confidentiality with no impact on integrity or availability. The CVSS 3.1 ve...

VulnCheck KEV: CVE-2024-11303

The pathname of the root directory to a Restricted Directory 'Path Traversal' vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2...

The vulnerability of Smartwares CIP-37210AT and C724IP IP cameras’ microprogramming software lies in the improper limitation of the path name to the restricted access directory. This allows intruders to gain unauthorized access to protected information.

The vulnerability of the Microprogrammed Software for Smartwares CIP-37210AT and C724IP cameras is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a intruder to gain unauthorized access to protected information...

CVE-2025-0359

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please...

The vulnerability of the ArcGIS Server server, related to incorrect restrictions on the path to the restricted catalog, allows attackers to gain unauthorized access to protected information.

The vulnerability of ArcGIS Server is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the ArcGIS Server server, related to incorrect restrictions on the path to the restricted catalog, allows attackers to gain unauthorized access to protected information.

The vulnerability of ArcGIS Server is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2025-1915

Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted Chrome Extension. Chromium security severity: Mediu...

Linux Distros Unpatched Vulnerability : CVE-2022-24808

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malform...

The vulnerability of IBM Engineering Lifecycle Optimization - Publishing software relates to incorrect restrictions on the path to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of IBM Engineering Lifecycle Optimization - Publishing software relates to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Ivanti Avalanche device management system, related to incorrect restrictions on the path name to the restricted access catalog, allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the Ivanti Avalanche device management system is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data...

Linux Distros Unpatched Vulnerability : CVE-2024-22116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping fo...

Linux Distros Unpatched Vulnerability : CVE-2020-3894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5,...

CVE-2025-0359

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please...