CVE-2023-45689

CVE-2023-45689 is a path traversal information-disclosure flaw in South River Technologies’ Titan MFT and Titan SFTP servers running on Windows and Linux. The root cause is insufficient path validation in the admin interface, enabling an authenticated user with administrative privileges to read a...

CVE-2023-26366 Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application t...

The vulnerability of the Red Hat Ansible configuration management system lies in the incorrect handling of references before accessing files. This allows attackers to re-write any files they desire.

The vulnerability of the Red Hat Ansible configuration management system is related to an incorrect definition of the reference before accessing a file. Exploiting this vulnerability could allow an attacker to re-write any files they desire...

CVE-2023-32182

A Improper Link Resolution Before File Access 'Link Following' vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before...

CVE-2023-41646

Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/...

Qlik Sense 输入验证错误漏洞

Qlik Sense is an application from Qlik USA. Allows users to create visualizations, charts, interactive dashboards and analytical applications for local and offline use. A security vulnerability exists in Qlik Sense Enterprise for Windows. An attacker could exploit the vulnerability to access file...

The vulnerability of the Runc command-line tool for isolated containers arises from incorrect handling of symbolic links before accessing the file. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Runc container launch tool is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2023-3256 Advantech R-SeeNet External Control of File Name or Path

Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files...

PT-2023-4568

Name of the Vulnerable Software and Affected Versions Google Guava versions 1.0 through 31.1 Description The issue is related to the use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava. This allows other users and apps on the machine with access t...

CVE-2023-27639

An issue was discovered in the tshirtecommerce aka Custom Product Designer component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter filename in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to...

CVE-2023-26215 TIBCO EBX® Add-ons Path Traversal

The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to read system files that are accessible to the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and...

CVE-2021-23166

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server...

CVE-2023-25940

Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isigatherinfo. A high privileged local attacker could potentially exploit this vulnerability, leading to system takeover and it breaks the compliance mode guarantees...

CVE-2023-25940

Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isigatherinfo. A high privileged local attacker could potentially exploit this vulnerability, leading to system takeover and it breaks the compliance mode guarantees...

VulnCheck KEV: CVE-2021-27876

Veritas Backup Exec BE Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine...

Race condition

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

CVE-2023-23520

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

CVE-2020-36559 Path Traversal in aahframe.work

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2019-25073 Path traversal in github.com/goadesign/goa

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...

CVE-2022-40607 IBM Spectrum Scale directory traversal

IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740...