PT-2024-8647 · Apple · Macos Sonoma +4

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.5 iPadOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 Description: A path handling issue was addressed with improved validation, which may allow a remote attacker to gain...

RHEL 5 : vim (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - vim: Integer overflow at an unserializeuep memory allocation site CVE-2017-6350 - vim before patch 8.0.00...

RHEL 5 : bash (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution CVE-2016-7543 - bash: when...

PT-2024-41139 · Apache · Apache Pinot

Уязвимость OLAP-хранилища данных Apache Pinot связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию путем отправки специально сформированного GET-запроса...

PT-2024-23618 · Unknown · Cloud Based Customer Service Management Platform

Name of the Vulnerable Software and Affected Versions: Cloud based customer service management platform version 1.0.0 Description: The issue allows a local attacker to execute arbitrary code via a crafted payload to the "Login.asp" component. This is related to a SQL Injection vulnerability...

PT-2024-19351 · Ibm · Ibm Txseries For Multiplatforms

Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms version 8.2 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM TXSeries for Multiplatforms version 8.2, consider...

CVE-2024-34346 Deno contains a permission escalation via open of privileged files with missing `--deny` flag

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access...

The vulnerability of Deepin-Reader, a program for viewing PDF and DjVu documents, arises due to an incorrect path limitation to the restricted access catalog. This allows a violator to execute arbitrary code.

The vulnerability of Deepin-Reader for viewing PDF and DjVu documents exists due to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the microprogramming software for Mitel series 6800, 6900, 6900w, and 6970 lies in the improper limitation of the path name to the restricted access catalog, allowing unauthorized access to protected information.

The vulnerability of the microprogramming software for Mitel series 6800, 6900, 6900w, and 6970 is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by sending a special...

CVE-2024-1678

The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post...

The vulnerability of the threat detection mechanism for Microsoft Defender for IoT involves an incorrect restriction on the path name to the restricted catalog, allowing attackers to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2024-24938

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.0.3 and 6.1 Description In affected versions, if a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to...

PT-2024-26517 · Tp Link · Tapo P125M +1

Name of the Vulnerable Software and Affected Versions: TP-Link Kasa KP125M version 1.0.0 Tapo P125M version 1.0.0 Build 220930 Rel.143947 Description: An Information Disclosure issue in the Telemetry component allows attackers to observe device state via observing network traffic. Recommendations...

GitLab 16.9 < 16.9.6 / 16.10 < 16.10.4 / 16.11 < 16.11.1 (CVE-2024-2434)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and...

CVE-2024-3375

Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84...

Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API

Description The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page...

BIT-GITLAB-2024-2434 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read...

The vulnerability in the iTop web tool for managing IT services arises from an incorrect limitation on the path to the restricted access catalog, allowing a perpetrator to disclose protected information.

The vulnerability of the iTop IT service management web tool is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from incorrect restrictions on the path name of the restricted directory. This allows attackers to expose protected information or cause service failures.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to disclose protected information or cause...

CVE-2024-2434

A flaw was found in GitLab. A path traversal issue could lead to a denial of service and restricted file read. This issue affects all versions of GitLab CE/EE 16.9 through 16.9.6, 16.10 through 16.10.4, and 16.11 through 16.11.1...