The vulnerability of the `getUserPrefMenuFragment` component of the Advantech iView network device and port management system allows a malicious individual to gain unauthorized access to protected information or execute arbitrary code.

The vulnerability of the getUserPrefMenuFragment component of the Advantech iView network device and port management system is related to an incorrect path name limitation for the restricted access directory during the processing of the MenuServlet. Exploiting this vulnerability could allow a...

The vulnerability of the Fortinet FortiPortal security analysis and management tool arises from incorrect path name restrictions for restricted access catalogs. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Fortinet FortiPortal security analysis and management tool is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a special...

The vulnerability of the Portainer container management platform lies in the incorrect limitation of the path name for the restricted access catalog, allowing attackers to upload arbitrary files into the system.

The vulnerability of the Portainer container management platform is related to incorrect restrictions on path names in the restricted access catalog. Exploiting this vulnerability allows a malicious actor to upload arbitrary files into the system remotely...

CVE-2022-25027

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked...

CVE-2023-22488 Missing authorization in Flarum

Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the...

ALPINE-CVE-2022-3592

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...

Spoofing

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...

PT-2023-14938 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/hss/classes/Users.php?f=delete" API endpoint. Recommendations: For...

Rocket Software TRUfusion 授权问题漏洞

Rocket Software TRUfusion is a simple, cost-effective solution from Rocket Software USA, Inc. It is used to ensure the secure exchange of CAD files and design data in PLM systems. A security vulnerability exists in Rocket Software TRUfusion Portal version v7.9.2.1, which originated from a...

CVE-2022-25027

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked...

Flarum 安全漏洞

Flarum is an open source forum system for the Flarum community. A security vulnerability exists in versions prior to Flarum v1.6.3. An attacker exploiting this vulnerability could read restricted/private content and bypass access checks for such content...

CVE-2022-25027

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked...

PT-2023-12776 · Rocket · Rocket Trufusion Portal

Name of the Vulnerable Software and Affected Versions: Rocket TRUfusion Portal version 7.9.2.1 Description: The issue concerns the Forgotten Password functionality, which allows remote attackers to bypass authentication. This is achieved by validating the user's session token when the "Password...

Flarum notifications can leak restricted content

Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through...

GHSA-8GCG-VWMW-RXJ4 Flarum notifications can leak restricted content

Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through...

CVE-2022-36441

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin...

PT-2023-13493 · Google +1 · Gboard +1

Name of the Vulnerable Software and Affected Versions: Zebra Enterprise Home Screen version 4.1.19 Description: An issue was discovered where the Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin. Recommendations: For...

Zebra Technologies Enterprise Home Screen 安全漏洞

Zebra Technologies Enterprise Home Screen is a free Android app from Zebra Technologies, Inc. provides administrators with an easy way to control access to applications and settings on Zebra devices. A security vulnerability exists in Zebra Technologies Enterprise Home Screen version 4.1.19, whic...

PT-2023-13603 · Asus · Asus Rt-Ax82U

Name of the Vulnerable Software and Affected Versions: Asus RT-AX82U version 3.0.0.4.386 49674-ge182230 Description: A denial of service issue exists in the cfg server cm processConnDiagPktList opcode of the router's configuration service. This can be triggered by a specially-crafted network...

PT-2023-11358 · Unknown · Happyman Twmap

Name of the Vulnerable Software and Affected Versions: happyman twmap versions prior to v2.9 v4.31 Description: A critical issue was found in happyman twmap, affecting an unknown functionality of the file twmap3/data/ajaxCRUD/pointdata2.php. The manipulation of the id argument leads to sql...