PT-2025-32346 · Unknown · Powered Blue Server

Name of the Vulnerable Software and Affected Versions: Powered BLUE Server versions 0.20130927 and prior Description: Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability that could lead to the disclosure of arbitrary files within the affected product...

CVE-2025-54959: Improper Limitation of a Pathname to a Restricted Directory

Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed...

Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...

GHSA-H7QF-QMF3-85QG Allure Report allows Improper XXE Restriction via DocumentBuilderFactory

Summary A critical XML External Entity XXE vulnerability exists in the xunit-xml-plugin used by Allure 2. The plugin fails to securely configure the XML parser DocumentBuilderFactory and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitra...

AMD uProf Connection Point Vulnerability

AMD uProf is a suite of performance analysis tools from AMD for analyzing the performance of x86 architecture applications on Windows, Linux and FreeBSD systems. AMD uProf suffers from a connection point vulnerability that can be exploited by attackers to cause arbitrary file deletion or disclosu...

CVE-2023-38490

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the Xml data handler e.g. Data::decode$string, 'xml' or the Xml::parse method in site or plugin code. The Kirby core does not use any of the...

CVE-2020-12668

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...

Alibaba Cloud Linux 3 : 0094: openwsman (ALINUX3-SA-2022:0094)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0094 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2019-3816: Openwsman, versions up to a...

PT-2025-18225 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns an arbitrary file disclosure in the Apache HTTP Server. No information is provided about the estimated number of potentially affected devices worldwide or...

Arbitrary File Disclosure

Vite is vulnerable to Arbitrary File Disclosure. The vulnerability is due to incorrect assumptions about the presence of in req.url, which is permitted by some runtimes Node, Bun despite being invalid per HTTP specs, allowing attackers to bypass file system access restrictions using path traversa...

Arbitrary File Disclosure

Vite is vulnerable to Arbitrary File Disclosure. The vulnerability is due to improper handling of trailing separators in query strings and is caused by the removal of trailing separators ? without proper validation in regex checks, allows attackers to bypass file access restrictions and retrieve...

Security Bulletin: There is a vulnerability in IBM Maximo Manage application that could allow an unauthenticated path-traversal leading to an arbitrary file disclosure (CVE-2024-22328)

Summary There is a vulnerability in IBM Maximo Manage application that could allow an unauthenticated path-traversal leading to an arbitrary file disclosure. Vulnerability Details CVEID:CVE-2024-22328 DESCRIPTION: IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to travers...

CVE-2024-52515: Use of Incorrectly-Resolved Name or Reference

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended...

ABB Cylon Aspect 3.08.01 logYumLookup.php Unauthenticated File Disclosure

ABB Cylon Aspect 3.08.01 logYumLookup.php Unauthenticated File Disclosure Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

Veertu Anka Build 路径遍历漏洞

Veertu Anka Build is a centralized dashboard from Veertu. A path traversal vulnerability exists in Veertu Anka Build version 1.42.0, which stems from the fact that a specially constructed HTTP request can lead to the disclosure of arbitrary files...

Veertu Anka Build 路径遍历漏洞

Veertu Anka Build is a centralized dashboard from Veertu. A path traversal vulnerability exists in Veertu Anka Build version 1.42.0, which stems from the fact that a specially constructed HTTP request can lead to the disclosure of arbitrary files...

Veertu Anka Build registry log files directory traversal vulnerability

Talos Vulnerability Report TALOS-2024-2061 Veertu Anka Build registry log files directory traversal vulnerability October 3, 2024 CVE Number CVE-2024-41922 SUMMARY A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted...

Pulse Secure VPN Arbitrary File Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pulse Secure VPN Arbitrary File Disclosure', 'Description' = %q This module exploits a pre-auth directory traversal in the Pulse Secure VPN serve...

Weave 安全漏洞

Weave is a toolkit for developing generative AI applications open-sourced by Weights & Biases. Weave has a security vulnerability that stems from an API that allows a remote user to fetch files from a specific directory, leading to remote traversal and disclosure of arbitrary files...

Typo3 Arbitrary File Disclosure in Form Component

Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields...