14524 matches found
Label Studio has a Path Traversal Vulnerability via image Field
Description A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...
CVE-2023-39553
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read fil...
CVE-2024-26580
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick 1 to solve it. 1...
SUSE CVE-2024-2746
Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit...
CVE-2024-12058
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...
CVE-2024-47266
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files...
CVE-2024-47266
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files...
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to incorrect handling of symbolic links before accessing files. This allows attackers to exploit their privileges.
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to incorrect handling of symbolic links before accessing files. Exploiting this vulnerability can allow attackers to increase their privileges...
CVE-2024-8550
A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...
CVE-2024-11343
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, unzipping an archive can lead to arbitrary file system access...
CVE-2024-11343 Telerik Document Processing Path Traversal
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, unzipping an archive can lead to arbitrary file system access...
CVE-2024-11343
CVE-2024-11343 affects In Progress® Telerik® Document Processing Libraries. A path traversal flaw exists when unzipping archives in versions prior to 2025 Q1 (2025.1.205), enabling arbitrary file system access. Public details consistently identify this as a path traversal issue and state that upg...
CVE-2025-26351
A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...
CVE-2025-23359
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use TOCTOU vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service,...
AZL-56857 CVE-2025-23359 affecting package nvidia-container-toolkit for versions less than 1.17.4-1
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use TOCTOU vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service,...
Mavenir SCE Application Provisioning Portal 安全漏洞
Mavenir SCE Application Provisioning Portal is an application provisioning portal from Mavenir USA. A security vulnerability exists in Mavenir SCE Application Provisioning Portal PORTAL-LBS-R10240 version, which originates from directory traversal leading to system file access...
PT-2025-7130 · Q Free · Q-Free Maxtime
Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to missing authentication for a critical function, allowing an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests. This is d...
The vulnerability of the Password Autofill component in operating systems such as visionOS, iOS, iPadOS, MacOS, and watchOS allows attackers to read and write arbitrary files.
The vulnerability of the Password Autofill component in the visionOS, iOS, iPadOS, MacOS, and watchOS operating systems is related to the absence of authentication. Exploiting this vulnerability allows attackers to read and write arbitrary files...
The vulnerability of the NVRAM Variable Handler in macOS operating systems allows a hacker to read and write arbitrary files.
The vulnerability of the NVRAM Variable Handler component in MacOS systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows an attacker to read and write arbitrary files...