CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-28976

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

CVE-2024-28976: Improper Input Validation

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the...

The vulnerability of the Dell Unity Operating Environment’s operating system for managing and maintaining data storage allows a malicious actor to gain unauthorized access to files stored in the server’s file system, with elevated privileges. This vulnerability is related to errors in processing the relative path to the directory, enabling unauthorized access to these files.

The vulnerability of the operating environment for managing and maintaining Dell Unity Operating Environment OE storage involves errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to write...

PT-2024-3198 · Oracle · Oracle Webcenter Portal

Name of the Vulnerable Software and Affected Versions: Oracle WebCenter Portal version 12.2.1.4.0 Description: The vulnerability in the Oracle WebCenter Portal product is related to insufficient protection of internal data. It allows a remote attacker to gain unauthorized access to read, add,...

CVE-2024-1654

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

CVE-2024-1654

PaperCut NG/MF (CVE-2024-1654) enables potential unauthorized write operations that may lead to remote code execution. Exploitation requires authenticated admin access and knowledge of both an internal system identifier and another valid user. CVSS v3.1 base score is 7.2 (HIGH) with NETWORK attac...

PaperCut NG/MF Security Vulnerabilities

PaperCut NG is a suite of next-generation printer control software from PaperCut Australia. A security vulnerability exists in PaperCut NG/MF that originates from allowing unauthorized write operations that could result in remote code execution...

CVE-2024-1654: Permissive List of Allowed Inputs

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

CVE-2024-20958

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Engineering Change Order. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed...

CVE-2024-22226

Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svcsupportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges...

HPESBGN04569 rev.1 - HPE Unified Mediation Bus (UMB), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Sensitive Information, URL Redirection, Unauthenticated Arbitrary Code Execution, Unauthorized Write Access to the File System, memory corruption, XML External Entity XXE, Host Header Injection; Remote: Bypass Security...

CVE-2023-42792 Apache Airflow: Improper access control to DAG resources

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

CVE-2023-3979

CVE-2023-3979 concerns GitLab. Affected versions: 10.6–16.2.7 (10.6 before 16.2.8), 16.0?–16.3.4 (16.3 before 16.3.5), and 16.0?–16.4.0 (16.4 before 16.4.1). The issue allows upstream collaborators to gain permission to write to the merge request source branch. The provided documents do not speci...

CVE-2023-39399

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39402: Improper Limitation of a Pathname to a Restricted Directory

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

CVE-2023-39403: Improperly Implemented Security Check for Standard

Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be read and written without authorization...

The vulnerability of the Fields plugin in the GLPI request and incident management system allows a hacker to write data into any field, including those for which he does not have access.

The vulnerability of the Fields plugin in the GLPI request and incident management system is related to the lack of access control checks. Exploiting this vulnerability allows an attacker to write data into any fields, including those for which they do not have authorized access...