CWE-610

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumvent sandbox restrictions.

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.

remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct: AndroidVersions: Android SoCAndroid ID: A-233972091

UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function.

Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allowing an attacker to gain remote code execution in common deployments.

Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe.

Podatność w funkcji Mail aplikacji Zoom Workplace dla Windows umożliwia niezautoryzowanemu użytkownikowi eskalację uprawnień poprzez sieć. Wysoka ocena CVSS 9.6 wskazuje na poważne zagrożenie dla integralności, poufności i dostępności systemu.

Tenable Terrascan w wersji v1.18.3 i wcześniejszych jest podatny na atak Server-Side Request Forgery (SSRF) poprzez parametr remote_url w endpoincie zdalnego skanowania katalogów. Atakujący bez uwierzytelnienia może odczytać lokalne pliki systemowe oraz wykraść dane uwierzytelniające przechowywane w pliku ~/.netrc.

Tenable Terrascan w wersji 1.18.3 i wcześniejszych jest podatny na atak Server-Side Request Forgery (SSRF) podczas przetwarzania szablonów IaC (ARM lub CloudFormation) przesłanych do serwera. Podatność jest szczególnie groźna, ponieważ narzędzie nie wymaga uwierzytelnienia, działa domyślnie na interfejsie 0.0.0.0, a projekt nie otrzyma już żadnych poprawek — został zarchiwizowany w sierpniu 2023 r.

W aplikacji gaizhenbiao/ChuanhuChatGPT w wersjach do 20240410 włącznie istnieje podatność umożliwiająca nieuwierzytelnionemu atakującemu zdalne nadpisanie krytycznych plików konfiguracyjnych systemu. Może to prowadzić do nieautoryzowanej zmiany zachowania aplikacji lub ustawień bezpieczeństwa, a także do wywołania stanu odmowy usługi (DoS).

Podatność w narzędziu Spin (platforma do budowania aplikacji serverless na WebAssembly) umożliwia atakującemu wymuszenie na aplikacji wykonania żądań do dowolnych hostów poprzez manipulację nagłówkiem HTTP `Host`. Dotyczy wersji wcześniejszych niż 2.4.3 i może prowadzić do poważnego naruszenia poufności oraz integralności danych.

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.

Oprogramowanie NamelessMC (platforma stron internetowych dla serwerów Minecraft) zawiera podatność umożliwiającą atakującemu zresetowanie hasła dowolnego użytkownika ręcznie zatwierdzonego przez administratora. Luka pozwala na całkowite przejęcie konta ofiary bez znajomości jej aktualnego hasła.

Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows remote authenticated users to obtain privilege via unspecified vectors.

HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.