697 matches found
CVE-2024-31441 Arbitrary File Reading in DataEase
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...
CVE-2024-31441 Arbitrary File Reading in DataEase
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...
CVE-2024-31441
DataEase (pre-1.18.19) is affected by an ARBITRARY FILE READ vulnerability due to lack of restrictions on ClickHouse connection parameters. An attacker can exploit certain malicious parameters to read arbitrary files. A fix is available in v1.18.19; upgrading to this version is recommended. Publi...
CVE-2024-31441 Arbitrary File Reading in DataEase
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...
PT-2024-24078 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.19 Description: DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain...
The vulnerability of the Rapid SCADA system, related to errors in processing the relative path to the catalog, allows a intruder to read arbitrary files.
The vulnerability of the SCADA system Rapid SCADA is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files by sending a specially crafted HTTP request...
Double free
Jenkins Git server Plugin 99.va0826abcdfad and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenki...
Jianghua Yaozu Autonomous County fordao network technology studio fordos document arbitrary file reading vulnerability
Forth Document is an open source online document system. Jianghua Yao Autonomous County for the road network technology studio for Si document arbitrary file reading vulnerability, an attacker can use the vulnerability to obtain sensitive information...
CVE-2023-50968
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes th...
Path traversal
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-46645 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-46645
CVE-2023-46645 describes a path traversal vulnerability in GitHub Enterprise Server that enables arbitrary file reading when building a GitHub Pages site. The attacker must have permission to create and build a GitHub Pages site on the affected server. Affected versions include all releases since...
CVE-2023-46645 Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...
CVE-2023-42783
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests...
MCL Technologies MCL-Net vulnerable to directory traversal
Overview Server software "MCL-Net" provided by MCL Technologies contains a directory traversal vulnerability CWE-22, CVE-2023-4990. Panasonic reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact Arbitrary files on the server may be read by an attacker...
Arbitrary file reading vulnerability in icc Intelligent Internet of Things Integrated Management Platform of Zhejiang Dahua Technology Co.
Zhejiang Dahua Technology Co., Ltd. is a leading supplier and solution provider of surveillance products. Zhejiang Dahua Technology Co., Ltd. icc Intelligent IOT Integrated Management Platform There is an arbitrary file reading vulnerability, which can be exploited by attackers to obtain sensitiv...
CVE-2023-4990
Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package P01 may allow attackers to read arbitrary files...
CVE-2023-42280
mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not verify the incoming data, resulting in arbitrary file reading...
