262 matches found
UReport2-console 代码问题漏洞
UReport2 is a high-performance pure Java reporting engine based on Spring architecture . A security vulnerability exists in all versions of UReport2-console, which can be exploited by an attacker to perform remote code execution, resulting in arbitrary file reads and deserialization of local...
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the incorrect restriction on the path name to the restricted catalog, allowing a hacker to read arbitrary files.
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications is related to an incorrect limitation on the path name used to access the restricted catalog. Exploiting this vulnerability could allow a malicious actor to read arbitrary files by sending a...
GHSA-WMRX-57HM-MW7R Arbitrary file reads in HashiCorp Nomad
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or...
Arbitrary file reads in HashiCorp Nomad
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or...
USN-5261-1 passenger vulnerabilities
It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to read arbitrary files. CVE-2017-16355 It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to perfor...
Arbitrary File Read
sphinxsearch:sid is vulnerable to arbitrary file reads by scattered file snippets...
Schneider Electric IGSS 路径遍历漏洞
Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes.Schneider Electric Interactive Graphical SCADA System is vulnerable to a path traversal vulnerability, which can be exploited by attackers to read arbitrary...
PortlandLabs Concrete Cms 代码问题漏洞
PortlandLabs Concrete Cms is a team-oriented open source content management system for the United States PortlandLabs . A path traversal vulnerability exists in PortlandLabs Concrete CMS, which stems from the product's failure to securely handle user input data. The vulnerability can be exploited...
JUMP 路径遍历漏洞
JUMP is an asset management solution from the French company JUMP. A security vulnerability exists in JUMP AMS version 3.6.0.04.009-2487, which stems from the application improperly restricting the loading of files on the server's file system, making it vulnerable to arbitrary file reads...
Dell Wyse Management Suite 路径遍历漏洞
DELL Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell USA. The product includes centralized Wyse endpoint management, asset tracking, and automated device discovery.Wyse Management Suite 3.2 and prior versions contain a security vulnerability that...
CVE-2021-29475 PDF export allows arbitrary file reads
HedgeDoc formerly known as CodiMD is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability t...
Cisco SD-WAN vManage 后置链接漏洞
Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. Cisco SD-WAN vManage suffers from a backlink vulnerability that stems from an insufficient file range restriction. An attacker could exploit...
jenkins: Arbitrary file read vulnerability in workspace browsers
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...
CVE-2020-24625
Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...
CVE-2020-24624
Unathenticated directory traversal in the DownloadServlet class execute method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...
Directory traversal
Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...
CVE-2020-24625
Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...
CVE-2020-24625
Summary: CVE-2020-24625 is an unauthenticated directory traversal vulnerability in the ReceiverServlet doGet() of Hewlett Packard Enterprise Pay per Use (PPU) Utility Computing Service (UCS) Meter, up to version 1.9 (vulnerability exists prior to 1.9). The root cause is lack of proper validation ...
CVE-2020-24624
CVE-2020-24624 describes an unauthenticated directory traversal in the DownloadServlet class’s execute() method on Hewlett Packard Enterprise’s Pay Per Use (PPU) Utility Computing Service (UCS) Meter, v1.9. The vulnerability allows an attacker to read arbitrary files via an improper validation of...