139 matches found
Youngerheart Nodeserver Path Traversal Vulnerability
nodeserver is a router that implements domain name resolution and web applications for node servers by the individual developer of youngerheart. A path traversal vulnerability exists in youngerheart nodeserver. An attacker could use this vulnerability to access files and directories stored outsid...
OpenCast File Directory Unauthorized Access
The vulnerability of the application for automatic capture, processing, management, and distribution of Opencast videos involves the use of files and directories accessible to external parties. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...
GHSA-QXP6-27GW-99CJ Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Due to a time-of-check to time-of-use TOCTOU race condition, the file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2. This allows attackers with Job/Workspace...
Huawei ManageOne Elevation of Privilege Vulnerability
Huawei Manageone is a cloud data center management solution from Huawei of China. huawei ManageOne is vulnerable due to a lack of checksum when the program uses certain parameters from external files. An attacker could use the vulnerability to construct a malicious file to achieve elevation of...
CVE-2021-32754
FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity XXE vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based...
FlowDroid code-related vulnerabilities
FlowDroid is a software application. A data flow analysis tool. A security vulnerability exists in FlowDroid versions prior to 2.9.0 that allows an attacker controlling a source/receiver definition file in XML format to read the file from an external location...
CVE-2020-24143
Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...
Cisco IOS XE SD-WAN Command-Line Interface Data Compromise
The vulnerability of the Cisco IOS XE SD-WAN software’s command-line interface relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a attacker to compromise the integrity of the protected information...
CVE-2020-24985
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...
CVE-2020-24985
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...
Design/Logic Flaw
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...
CVE-2020-24985
An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...
Design/Logic Flaw
In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product...
CVE-2020-27603
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
CVE-2020-27603
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
Improper access control
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
CVE-2020-27603
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
CVE-2020-27603
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...
PT-2020-16713
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.27 Description The issue is related to an unsafe JODConverter setting in BigBlueButton, which allows LibreOffice document conversions to access external files. This could potentially lead to security issues...
Bundler Code Execution
The vulnerability of the Bundler’s package manager in Ruby projects relates to the use of files and directories accessible from external sources. Exploiting this vulnerability could allow an attacker to execute arbitrary code...