Directory traversal

Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links...

PT-2023-11519 · Unknown · B3Log Wide

Name of the Vulnerable Software and Affected Versions: B3log Wide affected versions not specified Description: A Directory Traversal vulnerability was found, allowing an attacker to escalate privileges via symbolic links. Recommendations: At the moment, there is no information about a newer versi...

CVE-2020-19279

Summary (CVE-2020-19279) : The vulnerability is reported in B3log Wide (a web-based IDE) as a directory traversal that allows escalation of privileges through symbolic links. The connected sources consistently describe this as a privilege-escalation path via symbolic link handling. There is no cl...

b3log Wide 路径遍历漏洞

b3log Wide is a web-based integrated development environment IDE for the Go language. A security vulnerability exists in B3log Wide that stems from the program allowing an attacker to elevate privileges via symbolic links...

CVE-2020-19279

Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links...

CVE-2020-19279

Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links...

USN-5990-1 musl vulnerabilities

It was discovered that musl did not handle certain i386 math functions properly. An attacker could use this vulnerability to cause a denial of service crash or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS. CVE-2019-14697 It was...

TOTOLINK A7100RU downBw Parameter Command Injection Vulnerability

The TOTOLINK A7100RU is a wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home network connection. The TOTOLINK A7100RU suffers from a command injection vulnerability that stems from the downBw parameter of /setting/setWanIeCfg failing to properly filter...

CVE-2023-27231

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg...

The vulnerability of software for storing images with a wide dynamic range of brightness, related to pointer swapping errors, allows attackers to trigger a service failure.

The vulnerability of software for storing images with a wide dynamic range of brightness in OpenEXR is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Amazon Linux 2023 : unzip (ALAS2023-2023-029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-029 advisory. A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially...

On a compromised node, the virt-handler service account can be used to modify all node specs

Impact If a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can for instance read all secrets on t...

SUSE CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

ThinkPad BIOS Vulnerabilities - Lenovo Support US

No description provided...

PT-2023-19765 · NetGear · Netgear Rax Routers

Name of the Vulnerable Software and Affected Versions: Netgear RAX Routers affected versions not specified Description: The issue concerns unauthorized access and remote code execution RCE on WAN-side in Netgear RAX Routers. It was reportedly detectable by MANGO. There have been demonstrations of...

wide-ppp.jwwa.or.jp Cross Site Scripting vulnerability OBB-3207871

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Kubernetes vulnerable to path traversal

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-34838 CVE-2022-3162 affecting package keda for versions less than 2.14.0-1

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-31287 CVE-2022-3162 affecting package kubernetes for versions less than 1.25.4-0

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-13782 CVE-2022-3162 affecting package kube-vip-cloud-provider for versions less than 0.0.2-21

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...