Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03058)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozilla Firefox is vulnerable to an access control error that could be exploited by an unauthenticated attacker to access other restricted features...

PT-2023-12408 · Unknown · Eprintsug Ulcc-Core

Name of the Vulnerable Software and Affected Versions: eprintsug ulcc-core affected versions not specified Description: A critical issue was found in the file cgi/toolbox/toolbox, where the manipulation of the password argument leads to command injection. This issue can be exploited remotely...

Path Traversal

github.com/jfrazelle/pastebinit is vulnerable to path traversal. The vulnerability exists due to the improper path handling in the pasteHandler function of server.go, allowing an attacker to access files outside the restricted directory...

The vulnerability of the FortiSandbox threat detection and mitigation system lies in its improper restriction on the path to the restricted access catalog. This allows a violator to gain unauthorized access to protected information.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Huawei PCManager file transfer application lies in the incorrect limitation of the path name for the restricted access directory. This allows a perpetrator to move files along a specified path.

The vulnerability of the Huawei PCManager file transfer application lies in improper restrictions on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to transfer files through a specified path...

The vulnerability of Huawei FusionCube’s supervisor, related to incorrect restrictions on the path name to the restricted access catalog, allows a intruder to disclose protected information.

The vulnerability of Huawei FusionCube relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information through a specially crafted HTTP request...

PT-2022-25896 · WordPress · Contest Gallery Pro +1

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 19.1.5.1 Contest Gallery Pro WordPress plugin versions prior to 19.1.5.1 Description: The issue allows malicious users with at least author privilege to leak sensitive information from the...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

CVE-2022-45891

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads Upload2.ashx or access content uploaded by other users View.aspx after Ajax.asmx/SaveGrantAccessList...

PT-2022-27670 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows attackers to call restricted functions and perform unauthenticated uploads via the "Upload2.ashx" endpoint or access content uploaded by other users through "View.aspx"...

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage arises from incorrect path name restrictions related to restricted access directories. This vulnerability allows attackers to create or re-record critical files.

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage is related to an...

The vulnerability in the implementation of the /cgi-bin/wapopen HTTP-server Boa allows a hacker to gain unauthorized access to protected information.

The vulnerability in the /cgi-bin/wapopen HTTP-server implementation of Boa is related to incorrect restrictions on the path to the restricted directory during processing of the FILECAMERA variable. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected...

CVE-2022-28283

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox 99...

Vulnerability discovered in pfSense pfBlockerNG

Researchers have discovered a vulnerability in the pfBlockerNG package of pfSense. A malicious person could exploit it to execute arbitrary OS commands on the vulnerable system, when the malicious party has access to the web console of pfSense. It is good practice not to have such a console...

Directory Traversal

github.com/alist-org/alist is vulnerable to directory traversal. The vulnerability exists due to a lack of validation of the file upload permissions in the library, allowing an attacker to gain access to restricted files using ... / on the path URL...

CVE-2022-42535

In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2247701...

Sql injection

In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770203...

Sql injection

In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2247701...

CVE-2022-42535

In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2247701...

PT-2022-27877 · Unknown · Mesinkasir Bangresto

Name of the Vulnerable Software and Affected Versions: mesinkasir Bangresto version 1.0 Description: The issue is related to SQL Injection via the itemqty%5B%5D parameter. This allows for potential exploitation. Recommendations: For mesinkasir Bangresto version 1.0, consider restricting access to...