Secheron SEPCOS Control and Protection Relay: Access Control Vulnerability

The Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.The Secheron SEPCOS Control and Protection Relay is vulnerable to a...

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be use...

Information Disclosure

notebook is vulnerable to information disclosure. Authenticated attackers are able to access sensitive files, when the server root directory's only protection from the server is being hidden. The issue is there because the requests directed through ContentsManager.allowhidden = False command only...

CVE-2022-29238

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with ContentsManager.allowhidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files...

CVE-2022-29238

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with ContentsManager.allowhidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files...

Design/Logic Flaw

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

Cross site request forgery (csrf)

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to thi...

Amodat Mobile Application Gateway security vulnerabilities

Amodat Mobile Application Gateway is a mobile application gateway from Amodat Israel. A security vulnerability exists in Amodat versions prior to 7.12.00.09, which can be exploited by an attacker to read sensitive files on the system...

Google Android Information Leakage Vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to access sensitive files...

Google Android Information Leakage Vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to access sensitive files...

GHSA-GC62-J469-9GJM Rancher Privilege Escalation Vulnerability

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

WordPress Hover Effects plugin local file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Hover Effects plugin 2.1 and earlier versions have a local file inclusion vulnerability, which stem...

WordPress Herd Effects plugin local file inclusion vulnerability

WordPress and WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Herd Effects plugin 5.2 and earlier versions have a local file inclusion vulnerability, which stems from...

Multi Store Inventory Management System信息泄露漏洞

Multi Store Inventory Management System is a multi-store inventory management system. version 1.0 of Multi Store Inventory Management System contains an information disclosure vulnerability that could be exploited by attackers to access sensitive files...

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be used in...

GHSA-6GCG-HP2X-Q54H Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be used in...

WordPress Counter Box plugin local file inclusion vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Counter Box plugin is vulnerable to a local file inclusion vulnerability that stems from a lack of...

Tipask security vulnerabilities

Tipask is an open-source PHP question and answer system by the individual developer Song Dengfeng sdfsky in China. A security vulnerability exists in Tipask versions prior to 3.5.9, which is caused by a user inputting a path parameter that is not validated when downloading attachments. An attacke...

UNIX Symbolic Link (Symlink) Following

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's...

CVE-2022-24904

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's...