PT-2024-15563 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue allows managers to modify certain settings that they should not have access to, despite these settings being hidden in the UI for convenience. Managers can still modify these...

Path traversal

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...

CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

The vulnerability of the ConnectWise ScreenConnect remote access software lies in the incorrect restriction on the path name to the restricted directory. This allows a perpetrator to execute arbitrary code.

The vulnerability of the ConnectWise ScreenConnect remote access software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

PT-2024-20770 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.5.99.76 Tuleap Enterprise Edition versions prior to 15.5-4 Tuleap Enterprise Edition versions prior to 15.4-7 Description: Tuleap is an open source suite to improve management of software...

CVE-2024-1708 Improper limitation of a pathname to a restricted directory (“path traversal”)

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems...

CVE-2023-3976

A flaw was found in /etc/sudoers in Red Hat OpenStack. As a result of this misconfiguration in the sudoers file, the application is allowed to run restricted commands with root privileges. This issue could allow a local authenticated attacker to gain elevated privileges on the system. This flaw i...

PT-2024-21189 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 5.5.0 Description: The issue concerns a Blind SQL Injection vulnerability, specifically time-based, that can be exploited via the EID parameter in the EventEditor.php file. This allows for potential unauthorized access to...

PT-2024-17199 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Filterable Gallery Widget due to insufficient input sanitization an...

The vulnerability of the SolarWinds Access Rights Manager software relates to the possibility of bypassing the restricted access catalog, allowing a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager ARM software relates to the possibility of bypassing the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the SolarWinds Access Rights Manager software relates to the possibility of bypassing the restricted access catalog, allowing a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager ARM software relates to the possibility of bypassing the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the SolarWinds Access Rights Manager software relates to the possibility of bypassing the restricted access catalog, allowing a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager ARM software relates to the possibility of bypassing the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Dell Unity Command Injection Vulnerability

Dell Unity is a unified hybrid storage array for general purpose workloads both locally and in the cloud. A command injection vulnerability exists in Dell Unity, which can be exploited by a local attacker to escape a restricted shell and execute arbitrary OS commands with root privileges...

The vulnerability of the software for processing servlets in web applications on the Java Apache Sling Servlets Resolver platform arises from incorrect pathname restrictions for restricted directories. This allows attackers to execute arbitrary code.

The vulnerability of the software for processing servlets in web applications on the Java Apache Sling Servlets Resolver platform is related to incorrect pathname restrictions for restricted directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotel...

Dell Unity Command Injection Vulnerability (CNVD-2024-09160)

Dell Unity is a unified hybrid storage array for general purpose workloads both locally and in the cloud. A command injection vulnerability exists in Dell Unity, which can be exploited by a local attacker to escape a restricted shell and execute arbitrary OS commands with root privileges...

The vulnerability of the software for centralized control of printing devices, Kyocera Device Manager, arises from incorrect restrictions on the path to the restricted access catalog. This allows attackers to bypass the authentication process.

The vulnerability of the Kyocera Device Manager software for centralized control of printing devices is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

The vulnerability of the Java-security-toolkit application programming interface regarding security code management lies in improper restrictions on path names to restricted directories. This allows attackers to execute arbitrary code.

The vulnerability of the Java-security-toolkit application programming interface relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2024-1459

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories. Mitigation Mitigation for thi...

Intel Thunderbolt DCH drivers security vulnerability

Intel Thunderbolt DCH drivers is a driver for Windows from Intel Corporation USA. A security vulnerability exists in versions prior to Intel Thunderbolt DCH drivers 88, which stems from an improperly restricted buffer that could lead to information disclosure via local access by an authenticated...

Intel Thunderbolt DCH drivers security vulnerability

Intel Thunderbolt DCH drivers is a driver for Windows from Intel Corporation USA. A security vulnerability exists in versions prior to Intel Thunderbolt DCH drivers 88, which stems from an improperly restricted buffer that could allow privileged users to escalate privileges via local access...