PT-2025-2443

Name of the Vulnerable Software and Affected Versions: Intersec Geosafe-ea versions 2022.12 through 2022.14 Description: The issue allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified...

CVE-2024-35532

An XML External Entity (XXE) injection vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14 . This flaw allows an attacker to perform arbitrary file reading under the privileges of the running process, initiate SSRF requests , or trigger a Denial of Service (DoS) via...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-35532: Out-of-bounds Read

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-21549

The vulnerability concerns spatie/browsershot prior to 5.0.5. Improper URL validation in setUrl allows Local File Inclusion via view-source:file://, expanding a known bypass of CVE-2024-21549. Affected versions are before 5.0.5; remediation is to upgrade to 5.0.5 or newer to mitigate the issue.

CVE-2024-21549: Improper Input Validation

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-8058

An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading...

CVE-2024-10708

The System Dashboard WordPress plugin, in versions prior to 2.8.15 , is vulnerable to a path traversal attack due to a failure to validate user input used in a path. This flaw allows high-privilege users, such as administrators, to perform path traversal through the filename parameter in the sd_v...

CVE-2024-11978

CVE-2024-11978 affects DreamMaker from Interinfo and is described as a Path Traversal vulnerability that allows unauthenticated remote attackers to read arbitrary system files. The initial entry notes a CVSS v3.1 base score of 7.5 (Network, Privileges None, User Interaction None, Confidentiality ...

CVE-2024-11978 Interinfo DreamMaker - Arbitrary File Reading through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...

CVE-2024-11978 Interinfo DreamMaker - Arbitrary File Reading through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...

TRCore DVC Path Traversal Vulnerability

TRCore DVC is a file insurance system from TRCore China. TRCore DVC suffers from a path traversal vulnerability that stems from the program's failure to properly filter special elements in the path of a resource or file, which can be exploited by an attacker to read arbitrary system files...

CVE-2024-11067 D-Link DSL6740C - Arbitrary File Reading through Path Traversal

The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through...

CVE-2024-11067 D-Link DSL6740C - Arbitrary File Reading through Path Traversal

The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through...

CVE-2023-5816 Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading

The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only...

PT-2024-14835

Name of the Vulnerable Software and Affected Versions Code Explorer plugin for WordPress versions up to, and including, 1.4.5 Description The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading due to the lack of restriction on accessing files outside of the...

CVE-2023-5816: External Control of File Name or Path

The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only...