IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion

IPConfigure Orchid Core VMS 2.0.5 is susceptible to local file inclusion. id: CVE-2018-10956 info: name: IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion author: 0xAkoko severity: high description: | IPConfigure Orchid Core VMS 2.0.5 is susceptible to local file inclusion. impact: | An...

Joomla! Component JInventory 1.23.02 - Local File Inclusion

A directory traversal vulnerability in jinventory.php in the JInventory comjinventory component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1305...

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

Acrolinx Server <5.2.5 - Local File Inclusion

Acrolinx Server prior to 5.2.5 suffers from a local file inclusion vulnerability. id: CVE-2018-7719 info: name: Acrolinx Server 5.2.5 - Local File Inclusion author: 0xakoko severity: high description: | Acrolinx Server prior to 5.2.5 suffers from a local file inclusion vulnerability. impact: |...

VelotiSmart Wifi - Directory Traversal

VelotiSmart WiFi B-380 camera devices allow directory traversal via the uc-http service 1.0.0, as demonstrated by /../../etc/passwd on TCP port 80. id: CVE-2018-14064 info: name: VelotiSmart Wifi - Directory Traversal author: 0xAkoko severity: critical description: VelotiSmart WiFi B-380 camera...

Joomla! Component Arcade Games 1.0 - Local File Inclusion

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1714 info: name: Joomla! Component Arcade Games 1.0 - Local File Inclusion autho...

Business Directory Plugin <= 6.4.2 - SQL Injection

The Business Directory Plugin Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...

OneDev.io < 11.0.9 - Arbitrary File Read

Files on the host computer can be accessed by directory traversal. id: CVE-2024-45309 info: name: OneDev.io 11.0.9 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed by directory traversal. impact: | An attacker would be able to view the...

Copyparty <= 1.8.2 - Directory Traversal

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...

CVE-2024-33352

CVEID ：CVE-2024-33352 Bluestacks 公告 ID ：待定 受影响产品及版本名称 ：BlueStacks for Windows（10.40.1000.502 之前的版本） 漏洞类型 ：CWE-552：外部方可访问的文件或目录 摘要 BlueStacks 是一款 Android 模拟器，它在虚拟机中运行客户机 Android 系统。由于 BlueStacks 将虚拟机配置文件存储在全局可写目录中，并在不同的操作系统用户之间共享这些文件，非特权用户有可能对镜像植入后门，从而获得特权用户的代码执行能力。 描述 BlueStacks 配置全局存储在 ProgramDa...

CLEANSTART-2026-AO34403 temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com

Security vulnerability affects the apache-hive package. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com...

CLEANSTART-2026-NL20798 Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1

Security vulnerability affects the apache-hive package. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1...

CLEANSTART-2026-GO41173 Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly

Security vulnerability affects the apache-hive package. Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly...

PT-2026-108189

Name of the Vulnerable Software and Affected Versions Tenable Identity Exposure SaaS affected versions not specified Description A command injection flaw exists in the Active Directory Events Listener. This allows an authenticated attacker with low privileges to execute arbitrary commands with...

PT-2026-107864

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration CI system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers URIs within source download definitions, t...

PT-2026-107809

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...

PT-2026-108040

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

PT-2026-108308

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description On Windows, the Root.Mkdir and Root.MkdirAll functions can create a directory at a junction target that is located outside the root, provided the junction points...

ReconHound

ReconHound ReconHoundは、ペネトレーションテスター、バグバウンティハンター、そして倫理的ハッカーのために作られたPythonベースのWeb偵察ツールです。隠されたパス、ファイル、サブドメイン、クエリパラメータ、仮想ホスト、ファズ可能なエンドポイントを特定するのに役立ち、深層Web偵察のための多用途なソリューションです。 Features 高速なWeb列挙のためのマルチスレッドスキャン サポート: ディレクトリおよびファイルの発見 サブドメイン列挙 Hostヘッダーを介した仮想ホスト検出 クエリパラメータファジング...