XML External Entity Reference in jbpmmigration

It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXtern...

jDownloads 安全漏洞

jDownloads is a Joomla! extension for jDownloads to manage downloads. A security vulnerability exists in jDownloads version 3.9.8.2. An attacker can exploit the vulnerability to change some parameters in the address bar and view the names of other users' files...

Remote Code Execution

com.bstek.ureport:ureport2-console is vulnerable to remote code execution. A remote attacker is able to read sensitive user files and deserialize local gadgets by connecting the system to a malicious database server...

CVE-2022-22585

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files...

Debian DSA-5065-1 : ipython - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5065 advisory. - IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language...

UBUNTU-CVE-2022-21699

IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary...

CVE-2022-21699 Execution with Unnecessary Privileges in ipython

IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary...

CVE-2022-21699 Execution with Unnecessary Privileges in ipython

IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary...

Open-xchange OX App Suite Directory Traversal Vulnerability

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A directory traversal vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

CVE-2021-30947

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files...

CVE-2021-30947

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files...

CVE-2021-30947

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files...

Palo Alto Networks Cortex XDR Agent 代码问题漏洞

Palo Alto Networks Cortex XDR Agent is a client software for checking the security of client devices from Palo Alto Networks Malaysia. A security vulnerability exists in Palo Alto Networks Cortex XDR Agent that originates from improper control of user control files. The vulnerability can be...

PT-2021-6643 · Adobe · Adobe Creative Cloud Desktop Application

Name of the Vulnerable Software and Affected Versions: Adobe Creative Cloud Desktop Application version 2.4 and earlier Description: The issue is related to an insecure temporary file creation, which could allow an attacker to overwrite arbitrary files in the context of the current user...

CVE-2018-10867

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user...

Malicious Office 365 Apps Are the Ultimate Insiders

Phishers targeting Microsoft Office 365 users increasingly are turning to specialized links that take users to their organizations own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free...

ExpressionEngine: Import/Convert user file exposure leading to logins/passwords/PII leak.

The user data files processed through admin tools were stored in a predictable location, making them accessible without authentication due to an insecure system configuration...

CVE-2020-25612

The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Successful exploit could potentially allow an attacker to gain access to sensitive information...

Improper access control

The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Successful exploit could potentially allow an attacker to gain access to sensitive information...

PT-2020-16127

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions prior to 9.2 Description The issue is related to insufficient access control in the NuPoint Messenger component, which could allow an attacker with escalated privilege to access user files. This could potentially lead t...