CVE-2024-30246 Tuleap deleting or moving an artifact can delete values from unrelated artifacts

Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which...

Tuleap 安全漏洞

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A vulnerability exists in Tuleap Community Edition versions prior to 15.7.99.6, Tuleap Enterprise Edition...

PT-2024-23514 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: The issue is a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. Recommendations: For Tenda FH1203 version 2.0.1.6, as a temporary workaround, consider restricti...

The vulnerability of the AutomationDirect C-MORE EA9 HMI software-related to incorrect restrictions on path names in the restricted access catalog allows a intruder to trigger a service failure.

The vulnerability of the Microprogrammed Control Panel Software of AutomationDirect C-MORE EA9 HMI is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2023-6091 WordPress Theme Editor plugin <= 2.7.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1...

CVE-2024-30161

A flaw was found in the qt6 package where the WebAssembly wasm component may access the network reply header due to a dangling pointer. This issue may allow an attacker to gain access to restricted data, impacting data confidentiality and integrity...

Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Note: This requires WooCommerce to...

The possibility of the Apache Ivy package manager, due to incorrect restrictions on the path name to the restricted directory, allowing unauthorized users to gain unauthorized access to the file system.

The vulnerability of the Apache Ivy package manager is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the file system...

The vulnerability of Microprogrammed Software in Sharp, NEC’s P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 displays due to a incorrect restriction on the path name to the restricted access catalog. This allows an attacker to execute arbitrary code.

The vulnerability of Microprogrammed Software in Sharp, NEC’s P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, and MD551C8 displays due to an incorrect...

The vulnerability of the microprogramming software for UniLogic Studio series UniStream-controlled programmable logic controllers arises from incorrect restrictions on the path name to the restricted-access directory. This allows attackers to execute arbitrary code.

The vulnerability of the microprogramming software for UniLogic Studio programmable logic controllers of the UniStream series is related to an incorrect restriction on the path name of the restricted access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrar...

The vulnerability of the Apache OFBiz resource planning software lies in the incorrect restriction on the path name to the restricted directory. This allows attackers to bypass the authentication process.

The vulnerability of Apache OFBiz’s resource planning software lies in incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...

PT-2024-5022 · Qlik · Qlikview

Name of the Vulnerable Software and Affected Versions: Qlik Qlikview versions prior to May 2022 SR3 12.70.20300 and prior to May 2023 SR2 12.80.20200 Description: A race condition in the installer executable may allow an existing lower privileged user to cause code to be executed in the context o...

The vulnerability of the IBM FileNet Content Manager service for organizing, storing, and managing documents arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM FileNet Content Manager service for document organization, storage, and management is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

The vulnerability of the software for X-Rite’s MAT 6 Kohinoor integrated spectrophotometers arises from an incorrect limitation on the path name to the restricted access catalog. This allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The software vulnerability of the X-Rite MAT 6 Kohinoor spectrometer exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protecte...

PT-2024-21309 · Fujian Kelixin · Fujian Kelixin Communication Command/Dispatch Platform

Name of the Vulnerable Software and Affected Versions: Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 Description: A critical issue has been found, affecting an unknown part of the file /api/client/editemedia.php. The manipulation of the enterprise uuid argument leads t...

The vulnerability of the Jenkins HTML Publisher plugin relates to incorrect restrictions on the path to the restricted catalog, allowing attackers to read arbitrary files.

The vulnerability of the Jenkins HTML Publisher plugin is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially created HTTP request...

CVE-2023-38534

Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC...

CVE-2023-38534

Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC...

Authentication flaw

Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC...

CVE-2023-38534

OpenText Exceed Turbo X (versions 12.5.0 and 12.5.1) contains an improper authentication vulnerability that could disclose restricted information via unauthenticated RPC. The CVE-2023-38534 entry is supported by multiple feeds (NVD, Red Hat, PRION, etc.) with CVSS v3.1 base scores of 7.5 (AV:N/PR...