The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce products lies in the incorrect limitation of the path to the restricted catalog. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to incorrect path name restrictions for access to restricted catalogs. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in t...

Oracle Linux 7 : squid (ELSA-2022-22254)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-22254 advisory. - 7:4.11-3.0.1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested...

PT-2022-10571 · WordPress · Social Media Follow Buttons Bar

Name of the Vulnerable Software and Affected Versions: Social Media Follow Buttons Bar plugin versions prior to 4.74 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by an admin or higher-privileged user. The...

CVE-2022-20855

A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the...

CVE-2022-39034

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files...

Path traversal

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files...

CVE-2022-39034 Smart eVision - Path Traversal -2

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files...

PT-2022-24688 · Unknown · Smart Evision

Name of the Vulnerable Software and Affected Versions: Smart eVision affected versions not specified Description: The issue is related to a path traversal vulnerability in the Report API function. This vulnerability is caused by insufficient filtering for special characters in URLs, allowing a...

The vulnerability of the extract and extractall functions in the tarfile module of the Python interpreter allows a hacker to execute arbitrary code.

The vulnerability of the extract and extractall functions in the tarfile module of the Python interpreter is related to incorrect pathname restrictions for restricted access directories. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-1613

The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations in certain situations...

CVE-2022-1613 Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing

The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible to bypass IP-based limitations in certain situations...

CVE-2022-1613

The CVE-2022-1613 issue affects the Restricted Site Access WordPress plugin (versions before 7.3.2). The root cause is the plugin prioritizing certain HTTP headers over PHP’s REMOTE_ADDR when obtaining a visitor IP, enabling bypass of IP-based restrictions in some scenarios. The vulnerability is ...

PT-2022-25367 · Unknown · Wedding Planner

Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/admin/feature edit.php" API endpoint. Recommendations: For Wedding Planner versi...

PT-2022-14007 · WordPress · Restricted Site Access

Name of the Vulnerable Software and Affected Versions: Restricted Site Access WordPress plugin versions prior to 7.3.2 Description: The issue allows bypassing IP-based limitations in certain situations due to the plugin prioritizing a visitor's IP from certain HTTP headers over PHP's REMOTE ADDR...

WordPress plugin Restricted Site Access 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

The vulnerability in the web interface of the commutable managed distribution power supply PDU (iBoot-PDU), which allows a attacker to write a file to the root web directory.

The vulnerability in the web interface of the commutable managed distribution power unit PDU iBoot-PDU is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to write a file to the root web catalog...

Security Bulletin: Potential security vulnerabilities with JavaTM SDKs

Summary Smarter Infrastructure Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs. Vulnerability Details CVE IDs: CVE-2013-5456 CVE-2013-5457 CVE-2013-5458 CVE-2013-4041...

Ubuntu 20.04 LTS : etcd vulnerabilities (USN-5628-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-1 advisory. It was discovered that etcd incorrectly handled certain specially crafted WAL files. An attacker could possibly use this issue to cause a denial of...

Directory Traversal

ICEcoder is vulnerable to directory traversal. The vulnerability exists in multiple functions in classes/Settings.php and lib/settings.php where an attacker will gain unauthorized access to restricted directories and files outside of the web root folder using a HTTP exploit...

PT-2022-19981 · Unknown · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the WorkFlow module. This allows for potential exploitation via cross-site scripting. Recommendations: For versions...