262 matches found
CVE-2022-4140
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...
CVE-2022-27498
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...
Lansweeper 路径遍历漏洞
Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A path traversal vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of a path than there, a specially crafted...
Information Disclosure
electron-markdownify is vulnerable to information disclosure. An attacker is able to gain access to confidential information through local arbitrary file reads, because the application does not have a proper CSP policy and/or does not properly validate the contents of markdown files before...
PT-2022-26845 · Unknown · Simple E-Learning System
Name of the Vulnerable Software and Affected Versions: Simple E-Learning System version 1.0 Description: An information disclosure issue exists in the component "vcs/downloadFiles.php?download=./search.php" of Simple E-Learning System, allowing attackers to read arbitrary files. Recommendations:...
GHSA-7FXJ-FR3V-R9GJ TiDB vulnerable to Use of Externally-Controlled Format String
TiDB server importer CLI tool prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."...
TiDB vulnerable to Use of Externally-Controlled Format String
TiDB server importer CLI tool prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."...
PT-2022-20025 · Tidb · Tidb
Name of the Vulnerable Software and Affected Versions: TiDB versions prior to 6.4.0 TiDB versions prior to 6.1.3 Description: The issue concerns the use of an externally-controlled format string and data source name injection in the TiDB server. Specifically, the database name for generating and...
The vulnerability of the Moxa MXView network control software lies in its lack of functionality for checking the path name of the restricted access directory. This allows attackers to read arbitrary files.
The vulnerability of the Moxa MXView network control software is related to deficiencies in checking the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...
Adobe ColdFusion 代码问题漏洞
Adobe ColdFusion is a rapid application development platform from Adobe, which includes an integrated development environment and scripting language. The platform includes an integrated development environment and scripting language.Adobe ColdFusion has an XML external entity injection...
GHSA-GQ75-5GC3-RFWG snyk-broker Path Traversal before v4.73.0
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
snyk-broker Path Traversal before v4.73.0
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
CVE-2020-7649
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
CVE-2020-7649
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
Directory traversal
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
CVE-2020-7649 Directory Traversal
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...
CVE-2020-7649
CVE-2020-7649 affects the package snyk-broker prior to version 4.73.0. The vulnerability is a directory traversal issue (in the exports function when reading configs) that allows an attacker with access to Snyk’s internal network to read arbitrary files. Impact: confidentiality of data could be e...
Directory traversal
The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory...
CVE-2022-25856
The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory...
HTTP File Server 路径遍历漏洞
HTTP File Server is a simple tool that allows you to access your phone's files from your desktop, tablet or other device without any special software - just a web browser. A security vulnerability exists in HTTP File Server for Android version 1.4.1, which stems from a path traversal issue. An...