DHIS 2 安全漏洞

DHIS 2 is a software application. A flexible information system for data capture, management, validation, analysis and visualization. A security vulnerability exists in DHIS 2 Core versions prior to 2.36.13, prior to 2.37.8, and prior to 2.38.2, which stems from the fact that users may be able to...

CVE-2017-20184

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Carlo Gavazzi Powersoft up to version 2.1.1.1 allows an unauthenticated, remote attacker to download any file from the affected device...

PT-2023-22815 · Unknown · Tuleap Open Alm

Name of the Vulnerable Software and Affected Versions: Tuleap Open ALM versions prior to 14.7.99.143 Description: The title of an artifact is not properly escaped in the tooltip, allowing a malicious user with the capability to create an artifact or edit a field title to force a victim to execute...

CVE-2023-28406

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...

Directory traversal

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from the possibility th...

GitLab 12.0 < 15.10.5 / 15.11 < 15.11.1 (CVE-2023-1621)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to...

OESA-2023-1267 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free flaw was found in ndlcremove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.CVE-2023-1990 The Linux kernel before 6.2.9 has a race...

PT-2023-2616 · Myscada · Myscada Mypro

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions 8.26.0 and prior Description: The issue is related to insufficient checking of arguments passed to a command, allowing a remote attacker to execute arbitrary code in the operating system. An authenticated user could...

PT-2023-18968 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A critical issue has been found in the system, affecting the file /admin/inquiries/view inquiry.php. The manipulation of the id argument leads to SQL injection. This...

UBUNTU-CVE-2022-25277

Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference: SA-CORE-2019-010. However, the protections for these two vulnerabilities previously did...

Security Advisory - Identity Authentication Bypass Vulnerability in Huawei HiLink AI Life Product

Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.Vulnerability ID:HWPSIRT-2022-42291 This vulnerability has been assigned a CVEID:CVE-2022-48470...

The vulnerability of the FTP service for operating system network storage devices like My Cloud OS allows a hacker to gain full access to the device and execute arbitrary code.

The vulnerability of the FTP service in operating system network storage devices like My Cloud OS is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow an attacker to gain full access to the device and execute arbitrary code...

Discourse 3.1.x < 3.1.0.beta2 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

GHSA-X37V-36WV-6V6H Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

Impact The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricte...

The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers arises from incorrect restrictions on the path name in the restricted access catalog. This allows attackers to trigger a service failure.

The vulnerability of the microprogramming software for Schneider Electric’s spaceLYnk and homeLYnk logic controllers is related to an incorrect limitation on the path name in the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived allows a attacker to gain unauthorized access to protected information.

The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

PT-2023-8608 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 4.2-milestone-1 through 14.10 Description: The issue concerns the "restricted" mode of the HTML cleaner in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. This...

CVE-2023-29526 Async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

FANUC ROBOGUIDE-HandlingPRO

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: FANUC Equipment: ROBOGUIDE-HandlingPRO Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to read and/or overwrite files on the system running the affected...