GHSA-CGW6-F3MJ-H742 RustEmbed generated `get` method allows for directory traversal when reading files from disk

When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...

npm libpq 后置链接漏洞

npm libpq is a node-native binding to the PostgreSQL libpq C client library from npm USA. A backlink vulnerability exists in versions of libpq prior to 1.7.1, which stems from the fact that Read calls to g GitArtifactReader.readFromRepository do not check for files containing trigger resource...

Tenable Network Security Nessus 输入验证错误漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. An input validation error vulnerability exists in Tenable Network Security Nessus Agent version 10.1.3 and earlier versions, which can be exploited by an authenticated attacker to re...

Jenkins plugins Multiple Vulnerabilities (2022-02-15)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Multiple Pipeline-related plugins that perform on-controller SCM checkouts reuse the same workspace directory for checkouts of distinct SCM...

CVE-2021-42811

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed...

convert-svg 代码注入漏洞

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in versions of convert-svg prior to 0.6.3, which stems from the use of specially crafted SVG files that can read arbitrary files from the file system and the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ... Details A...

Razer Sila Gaming Router 安全漏洞

The Razer Sila Gaming Router is a router for gaming from Razer USA. A security vulnerability exists in the Razer Sila Gaming Router version 2.0.441api-2.0.418, which stems from the presence of a local file inclusion issue. An attacker can read arbitrary files through this vulnerability...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

Design/Logic Flaw

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

CVE-2022-29720

CVE-2022-29720 affects 74cmsSE v3.5.1. A vulnerability in index\controller\Download.php enables an arbitrary file read. Documented references confirm the component and location; no exploit details or remediation are provided in the supplied sources. If applicable, apply vendor advisories or patch...

Arbitrary File Read

github.com/gphper/ginadmin is vulnerable to arbitrary file read. The vulnerability exists in couple of functions in adminSystemController.go because the incoming path value is not filtered which allows an attacker to gain access to the files and read sensitive information...

Arbitrary file read in ginadmin

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A patch is available on the master branch of the repository...

PT-2022-23726 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.3.101 Description: This issue allows remote attackers to read arbitrary files on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...

74cms 安全漏洞

XUNYI TECHNOLOGY 74cms is a PHP and MySQL based online recruitment system from China Xunyi Technology Company. A security vulnerability exists in version 74cmsSE v3.5.1, which originates from an arbitrary file read vulnerability in indexcontrollerDownload.php...

CVE-2022-26067

An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this...

Information disclosure

An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequence of requests to trigger this...