Prolonged Pursuit of OilRig APT Targeting Middle East Government

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Iran-affiliated threat actor known as OilRig orchestrated a sophisticated eight-month campaign directed at the Middle East government, during which the attackers managed to steal sensitive files and...

CVE-2023-45690

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

Default credentials

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690 Information leak via default file permissions on Titan MFT and Titan SFTP servers

Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem...

CVE-2023-45690

CVE-2023-45690 is part of a set of post-authentication issues in South River Technologies’ Titan MFT/SFTP servers (Linux) that were disclosed by multiple sources. Connected documents show concrete details: (1) 45690 describes an information leak via a world-readable database and logs, enabling an...

South River Technologies TitanFTP NextGen Security Vulnerability

South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen versions prior to 2.0.18, which stems from a defau...

PT-2023-13234 · Ibm · Ibm Security Directory Server

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Server version 6.4.0 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the...

CVE-2023-23366

A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Stati...

CVE-2022-4244 Codehaus-plexus: directory traversal

A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...

Path traversal

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

Gladys Assistant Path Traversal Vulnerability

Gladys Assistant is a source home assistant software from Gladys Assistant open source. A path traversal vulnerability exists in Gladys Assistant v4.26.1 and earlier versions, which originates from a vulnerability that allows an authenticated attacker to extract sensitive files from the host by...

Arbitrary File Read

OpenRefine is vulnerable to Arbitrary File Read. The vulnerability due to improper jdbc url sanitization, which allows an attacker to set the allowLoadLocalInfile value to true by passing it through the databaseName parameter. This can be exploited to read sensitive internal server files...

Path Traversal

org.graylog, graylog-project-parent is vulnerable to Path Traversal. The vulnerability exists because it does not properly validate user input in the HTTP API resource, which allows an attacker to overwrite or modify sensitive files in the system...

PT-2023-21753 · Tigergraph · Tigergraph Enterprise

Name of the Vulnerable Software and Affected Versions: Tigergraph Enterprise version 3.7.0 Description: An issue was discovered in the GSQL query language, which allows users to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable v...

Information Disclosure

librsvg is vulnerable to Information Disclosure. This vulnerability occurs when Libsvg parses a specially crafted SVG file that contains a directory traversal sequence. If the file is valid, Libsvg could allow the user to access files outside of the intended directory. This could be exploited by ...

Directory Traversal

gitLab is vulnerable to a directory traversal. The vulnerability occurs because GitLab does not properly validate the URL of a webhook. An attacker can exploit this vulnerability by creating a malicious webhook with a URL that contains a crafted directory traversal sequence. This will cause GitLa...

Information Disclosure

nagvis is vulnerable to Information Disclosure. This vulnerability occurs when Nagvis parses a specially crafted URL that points to a file on the Nagvis server. If the file exists, Nagvis will read the contents of the file and display it in the web interface which can be exploited by an attacker ...