PT-2023-32425 · Campcodes · Campcodes Simple Student Information System

Name of the Vulnerable Software and Affected Versions: Campcodes Simple Student Information System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /admin/courses/manage course.php. The manipulation of the id argument leads to...

CVE-2023-5358

Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters...

CVE-2023-20155

A vulnerability in a logging API in Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to cause the device to become unresponsive or trigger an unexpected reload. This vulnerability could also allow an attacker with valid user credentials, but not...

PT-2023-29920 · Apache · Apache

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10 Description: The issue affects FOG, a free open-source cloning/imaging/rescue suite/inventory management system. An endpoint intended for authenticated users to have limited enumeration abilities was accessible to...

StakedUSDe contract allows attackers to steal staked USDe tokens of soft-restricted users

Lines of code Vulnerability details Description The modifier called checkMinShares that is used to ensure that there is always a small non-zero amount of shares in circulation. This is to prevent a donation attack, where an attacker donates a small amount of USDe tokens to the contract and then...

The vulnerability of the fileRead() function in the NocoDB database creation platform allows a attacker to gain unauthorized access to protected information.

The vulnerability of the fileRead function in the NocoDB database creation platform is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

SOFT_RESTRICTED_STAKER_ROLE is able to withdraw stUSDe for USDe even if it shouldnt

Lines of code Vulnerability details As the readme mentions, SOFTRESTRICTEDSTAKERROLE shouldnt be able to deposit or withdraw their USDe/stUSDe: Due to legal requirements, there's a SOFTRESTRICTEDSTAKERROLE and FULLRESTRICTEDSTAKERROLE. The former is for addresses based in countries we are not...

The vulnerability of the Lightdash data visualization and analysis tool lies in the improper restriction of the path name to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Lightdash data visualization and analysis tool is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the samba networking interaction software library smbd, which allows a hacker to trigger a service failure.

The vulnerability of the samba networking software library smbd is related to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2023-41982

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to use Siri to access sensitive user data...

CVE-2023-42488

EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to gain access to confidential information.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

PT-2023-30009 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was found, related to the sub 415258 function. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider restricting access to the sub...

PT-2023-26629 · Unknown · Tire-Sales Line

Name of the Vulnerable Software and Affected Versions: tire-sales Line version 13.6.1 Description: An issue in the software allows a remote attacker to obtain sensitive information via a crafted GET request. Recommendations: For version 13.6.1, consider restricting access to sensitive information...

Alexander Maier EisBaer Scada Path Traversal Vulnerability

Alexander Maier EisBaer Scada is a visual reality display and control program created on Windows operating systems by Alexander Maier of Germany. Alexander Maier EisBaer Scada suffers from a path traversal vulnerability that stems from an incorrect restriction on pathnames to restricted directori...

The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to gain access to confidential information.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

PT-2023-29857

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides web application is vulnerable to a Server-Side Request Forgery SSRF attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing...

8x8: Unprotected Atlantis Server at https://152.70.█.█

The Atlantis test server at https://152.70.█.█ was found to be exposed without protection. Atlantis is an application used to automate Terraform via pull requests. The issue was identified and resolved by restricting access to the Atlantis service...