Vulnerabilidades

Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.

A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Azure CycleCloud Remote Code Execution Vulnerability

Azure CycleCloud Remote Code Execution Vulnerability

Azure CycleCloud Remote Code Execution Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.

Azure CycleCloud Elevation of Privilege Vulnerability

A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to…

All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.

In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).

In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).

Azure CycleCloud Elevation of Privilege Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.

CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.