WordPress plugin Vikinger has a path traversal vulnerability

WordPress Vikinger is a WordPress blog theme developed by a foreign developer. WordPress Vikinger has a path traversal vulnerability that stems from insufficient file path validation in the function vikingerdeleteactivitymediaajax, which can be exploited by an attacker to tamper with the system...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the AddTemp function. An attacker can access or modify files outside the intended directory by supplying crafted input to the filename parameter. Details A Directory Traversal attack also known as path traversal...

CVE-2020-24985

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...

GitLab EE File Access Unauthorized Information Disclosure

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...

CVE-2024-51966

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or...

CVE-2024-51958

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or...

M-Files Server Unauthorized Access

The vulnerability of the M-Files Server platform for document automation involves the use of files and directories accessible to external parties. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2025-7694 · Unknown · Divi Donation Modules

Name of the Vulnerable Software and Affected Versions: Give – Divi Donation Modules versions prior to 2.0.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into externally-accessible files or directories. Recommendations: For...

EsafeNet CDG security vulnerability

EsafeNet CDG is a document security management system from EsafeNet, China. A security vulnerability exists in EsafeNet CDG version 5. An attacker can exploit the vulnerability to access files and directories stored outside the web root folder...

National Keep CyberMath has a security vulnerability

National Keep CyberMath is a cybersecurity risk analysis tool for organizations from National Keep. A security vulnerability exists in versions prior to National Keep CyberMath CYBM.240816253, which stems from the presence of an external-party-accessible file or directory vulnerability that could...

SailPoint Delimited File Connector security vulnerability

SailPoint Delimited File Connector is a read-only and rule-driven connector from SailPoint. A security vulnerability exists in the SailPoint Delimited File Connector that stems from a file path traversal vulnerability that could allow an authenticated administrator to set arbitrary connector...

Schneider Electric Easergy T200 Unauthorized Access

The vulnerability of the microprogramming software used in Schneider Electric Easergy T200 remote control devices lies in the use of files and directories accessible to external parties. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

PT-2024-1682 · Vmware · Vmware Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations for Networks affected versions not specified Description: The issue is related to a local file read vulnerability in VMware Aria Operations for Networks. This vulnerability can be exploited by a malicious actor with adm...

Honeywell PM43 Privilege Escalation

The vulnerability of Honeywell PM43 industrial printer’s microprogramming software is related to the use of files and directories accessible from external parties. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-6194: Improper Restriction of XML External Entity Reference

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...

PT-2023-29482 · Yamcs · Yamcs

Name of the Vulnerable Software and Affected Versions: Yamcs version 5.8.6 Description: The issue allows for Cross-Site Scripting XSS attacks. It comes with a Bucket as its primary storage mechanism, which allows for the upload of any file. There's a way to upload a display referencing a maliciou...

Theft of Arbitrary Files due to lack of intent validation and insecure usage of provider paths in TTFViewerActivity.kt

Description Through the use of Oversecured, leading vulnerability scanner for Android and iOS applications, we were able to detect an Theft of Arbitrary Files vulnerability within TTFViewerActivity.kt. Check full issue definition in the image below: Root Cause Analysis The TTFViewerActivity faile...

PT-2023-8730 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.6.0 Description: The issue is related to the use of files and directories accessible to external parties, which can be exploited by a remote attacker to execute arbitrary code. Different users in InLong...

CVE-2020-17354

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, sa...

PT-2023-1541 · Delta Electronics · Dopsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics DOPSoft versions 4.00.16.22 and prior Description: The issue is related to an out-of-bounds write in the DOPSoft software, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced ...