Huawei EulerOS: Security Advisory for git (EulerOS-SA-2023-1502)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0223

An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is...

Path Traversal in code

Description The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. Proof of Concept Code that has the...

Nextcloud: Users can set up workflows using restricted and invisible system tags

Vulnerability description not provided...

8x8: Unprotected Atlantis Server at https://132.226.█.█

Vulnerability description not provided...

PT-2023-1907 · Unknown · Mxsecurity

Name of the Vulnerable Software and Affected Versions: MXsecurity version 1.0 Description: The issue is related to a command injection vulnerability in the SSH CLI program of MXsecurity. This vulnerability can be exploited by attackers who have gained authorization privileges, allowing them to...

CVE-2022-27490

A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4,...

Fortinet FortiOS 路径遍历漏洞

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam, etc. SSL...

Goutil 路径遍历漏洞

Goutil is a library of some tool functions commonly used by Go. A path traversal vulnerability exists in versions of Goutil prior to 0.6.0, which stems from an improper restriction of pathnames to restricted directories in the software...

Out-of-bounds Read

Linux kernel is vulnerable to out-of-bounds read vulnerability. The vulnerability exists to due to type confusion condition which allows to attacker to getting access to restricted data...

Out-of-Bounds Read

linux is vulnerable to Out-of-Bounds Read. This affects the function fibnhmatch of the file net/ipv4/fibsemantics.c of the component IPv4 Handler, leading to out-of-bounds read which results in attackers getting access to restricted data...

The vulnerability of the microprogramming software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND (9.0), and TL-WR841ND allows a hacker to bypass authentication procedures and read or write arbitrary files into the system.

The vulnerability of the microprogrammed software of TP-Link Archer C5, C7, C8, C9, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND, TL-WR841ND 9.0, and TL-WR841ND is related to incorrect restrictions on path names in the restricted access directory. Exploiting this vulnerability allows a malicious...

The vulnerability of the WYSIWYG editor Ckeditor arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to load arbitrary files.

The vulnerability of the WYSIWYG editor Ckeditor is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to download arbitrary files remotely...

The vulnerability of FortiWeb web applications’ network firewalls arises from incorrect restrictions on the path to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of FortiWeb web applications’ network firewalls is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a special...

GHSA-H6F5-8JJ5-CXHR xwiki-platform vulnerable to Remote Code Execution in Annotations

Impact The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. To reproduce: add an annotation with the content groovyprint "hello"/groovy and click the yellow scare to g...

PT-2023-20666 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 2.3-milestone-1 through 13.10.10 XWiki Platform versions 14.4.6 and earlier XWiki Platform versions prior to 14.10 Description: The annotation displayer in XWiki Platform does not execute content in a restricted contex...

PT-2023-20662 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 11.6-rc-1 through 14.8 XWiki Platform versions 14.4.0 through 14.4.5 XWiki Platform versions 13.10.0 through 13.10.9 Description: The XWiki Platform is a generic wiki platform where comments are supposed to be executed...

The vulnerability of FortiWeb web applications’ network firewalls arises from incorrect restrictions on the path to the restricted access catalog, allowing attackers to gain unauthorized access to protected information.

The vulnerability of FortiWeb web applications’ network firewalls is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a special...

The vulnerability of the server-side application library for creating reports from TIBCO JasperReports Library, JasperReports Library for ActiveMatrix BPM, JasperReports Server, JasperReports Server for AWS Marketplace, and JasperReports Server for ActiveMatrix BPM arises from an incorrect limitation on the path to the restricted directory. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the server-side application libraries for creating reports, such as the TIBCO JasperReports Library, JasperReports Library for ActiveMatrix BPM, JasperReports Server, JasperReports Server for AWS Marketplace, and JasperReports Server for ActiveMatrix BPM, is related to an...

PT-2023-21056 · Git +1 · Opencats

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious...