14464 matches found
CVE-2025-40757
A vulnerability has been identified in APOGEE PXC Series BACnet All versions, APOGEE PXC Series P2 Ethernet All versions, TALON TC Series BACnet All versions. Affected devices connected to the network allow unrestricted access to sensitive files, such as databases. This could allow an attacker to...
Xbox Gaming Services Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Xbox allows an authorized attacker to elevate privileges locally...
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...
CVE-2025-42926 Missing Authentication check in SAP NetWeaver Application Server Java
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...
PT-2025-36896
Name of the Vulnerable Software and Affected Versions: Microsoft AutoUpdate affected versions not specified Description: An improper link resolution before file access 'link following' in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally. Recommendations: At the...
PT-2025-36894
Name of the Vulnerable Software and Affected Versions: Xbox affected versions not specified Description: An improper link resolution issue before file access 'link following' exists in Xbox, potentially allowing a local attacker to elevate privileges. Recommendations: At the moment, there is no...
Copyparty 安全漏洞
Copyparty is a portable file server for ed individual developers. A security vulnerability exists in Copyparty versions prior to 1.19.8, which stems from a missing permission check that could lead to overstepping file access rights...
@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +192 more potentially affected by CVE-2025-58752 via vite (>=6.0.0, <=6.3.5)
vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.55.0, =0.21.2-4.1, =0.21.23 and more Source...
Vite 访问控制错误漏洞
Vite is a new front-end build tool from Vite Open Source. An access control error vulnerability exists in Vite versions prior to 7.1.5, 7.0.7, 6.3.6, and 5.4.20, which stems from file access that bypasses the server.fs setting...
CVE-2023-21468
Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...
CVE-2025-48544
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-32323
In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...
CVE-2025-52551
E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system...
XML External Entity (XXE) Injection
Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via insecure use of etree.iterparse parsing. An attacker can access sensitive information by submitting crafted XML payload with referencies to local files. Details XXE Injection is a type of attack...
Inclusion of Functionality from Untrusted Control Sphere
Overview Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to incomplete LaTeX sanitization that fails to block the verbatim package. The Latex handling module overlooks the verbatim package during sanitization, allowing specially...
Linux Distros Unpatched Vulnerability : CVE-2012-3363
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZendXmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to rea...
CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
XWiki configuration files can be accessed through jsx and sx endpoints
Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false. This can apparently be reproduced on Tomcat instances. Patches This has been patched in 17.4.0-rc-1, 16.10.7. Workarounds...
GHSA-M63C-3RMG-R2CF XWiki configuration files can be accessed through jsx and sx endpoints
Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false. This can apparently be reproduced on Tomcat instances. Patches This has been patched in 17.4.0-rc-1, 16.10.7. Workarounds...