808 matches found
CVE-2022-2943: Improper Limitation of a Pathname to a Restricted Directory
The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the almrepeatersexport function. This makes it possible for authenticated attackers, with administrative...
Arbitrary File Read Vulnerability in Istar Database Auditing System
Founded in 2003, Beijing Yisetong Technology Development Co., Ltd. is a professional and comprehensive data security vendor in the field of data security. There is an arbitrary file reading vulnerability in Yisetong database auditing system, which can be exploited by an attacker to read any file ...
Moodle arbitrary file reading vulnerability
Moodle is a free and open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment.Moodle suffers from an arbitrary file reading vulnerability, which stems from insufficient path checking and can be exploited by...
CVE-2022-35741
Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity XXE injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When...
CVE-2022-35741: Improper Restriction of XML External Entity Reference
Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity XXE injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When...
GHSA-5824-6JFV-XR3R Arbitrary file read in ginadmin
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A patch is available on the master branch of the repository...
CVE-2022-30428
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
CVE-2022-30428
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
CVE-2022-30428
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
Design/Logic Flaw
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
CVE-2022-30428
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
CVE-2022-30428
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
CVE-2022-30428
CVE-2022-30428 affects ginadmin (up to 05-10-2022). The vulnerability arises from an unfiltered incoming path value, allowing an arbitrary file read from the server. Affected component appears to be the admin/system handling path input; the issue enables access to sensitive files, as described co...
CVE-2022-30428: Files or Directories Accessible to External Parties
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading...
Open Automation Software OAS Platform 访问控制错误漏洞
Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. An information disclosure vulnerability exists in Open Automation Software OAS Platform version V16.00.0112, which stems from an information disclosure issue in the OAS Engine...
ginadmin 安全漏洞
ginadmin is a backend management platform based on the Gin framework for individual GPER developers in China. A security vulnerability exists in ginadmin 05-10-2022 and earlier versions, which stems from an unfiltered incoming path value, leading to arbitrary file reading...
PT-2022-20113
Name of the Vulnerable Software and Affected Versions ginadmin through 05-10-2022 Description The issue arises from the lack of filtering on the incoming path value, leading to arbitrary file reading. Recommendations For ginadmin through 05-10-2022, update to a version that includes the fix...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...
Esri ArcGIS Enterprise Portal for ArcGIS组件XXE漏洞
Esri ArcGIS Enterprise is a GIS Geographic Information System base software system from the Environmental Systems Research Institute Esri, Inc. The system supports mapping and visualization, analysis, and data management, etc. An XXE vulnerability exists in the Esri ArcGIS Enterprise Portal for...