CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-42732

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s...

CVE-2022-39347

CVE-2022-39347 affects FreeRDP: vulnerable in affected FreeRDP clients due to missing path canonicalization and base path checks on the drive channel, allowing a malicious server to trick a client into reading files outside the shared directory. The issue has been addressed in version 2.9.0; user...

CVE-2022-26884 Apache DolphinScheduler exposes files without authentication

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher...

PT-2022-26302 · Lavalite · Lavalite

Name of the Vulnerable Software and Affected Versions: Lavalite version 9.0.0 Description: The issue allows for path traversal attacks through the XSRF-TOKEN cookie, enabling read access to arbitrary files on the server. Recommendations: For Lavalite version 9.0.0, consider restricting access to...

CVE-2021-22685

The CVE-2021-22685 issue is a path-traversal vulnerability in Cassia Networks Access Controller prior to version 2.0.1. The flaw allows an attacker to use the minify route with a relative path to view arbitrary server files, potentially exposing sensitive data. Affected product: Cassia Networks A...

CVE-2022-41235

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system...

CVE-2022-38614

CVE-2022-38614 affects SmartVista Cardgen v3.28.0, specifically the IGB Files and OutfileService features. The issue allows attackers to list and download arbitrary files by modifying the PATH parameter. Public sources across NVD/Red Hat/CVE records confirm the exposed component and impact, with ...

CVE-2022-36869

Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permission...

CVE-2022-36082 mangadex-downloader vulnerable to unauthorized file reading

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

SAMSUNG Internet Browser 安全漏洞

SAMSUNG Internet Browser is a Samsung Browser from Samsung South Korea. A security vulnerability exists in SAMSUNG Internet Browser versions prior to 17.0.7.34, which stems from an implicit Intent hijacking vulnerability that can be exploited by an attacker to access arbitrary files...

CVE-2021-44052 Arbitrary file read

An improper link resolution before file access 'Link Following' vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the...

Signiant Manager + Agents 代码问题漏洞

Signiant Manager + Agents is an enterprise-grade, accelerated file transfer solution from Signiant Corporation. A code issue vulnerability exists in Signiant Manager + Agents, which allows an attacker to access and extract any file on the system to steal sensitive information when the product is...

CVE-2022-24716

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolv...

SUSE-SU-2022:0720-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23648: A specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host bsc1196441...

The vulnerability of the Apex One antivirus software lies in its improper handling of links before accessing a file, allowing attackers to escalate their privileges.

The vulnerability of the anti-virus software Apex One is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a hacker to increase their privileges...

Opmantek Open-AudIT 路径遍历漏洞

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek, Inc. The program intelligently scans networks and network devices and provides status reports.Opmantek Open-AudIT suffers from a path traversal vulnerability that can be exploited by attackers to read file...

The vulnerability of the FilePath#reading(FileVisitor) component in the Jenkins automation server allows a malicious actor to have unlimited access to read files by using certain operations.

The vulnerability of the FilePathreadingFileVisitor component in Jenkins automation servers is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to gain unlimited access to files by performing certain operations...

CVE-2021-30828

This CVE (CVE-2021-30828) affects macOS Big Sur before the fixed build. The issue allows a local user to read arbitrary files as root due to insufficient checks, with a fix shipped as Security Update 2021-005 Catalina and macOS Big Sur 11.6. The Security Update addresses the vulnerability by corr...

CVE-2021-1546

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by running a CLI command that targets an...