The vulnerability of the software for monitoring and analyzing network traffic in industrial networks, SINEC Traffic Analyzer, arises from the lack of access control over files. This allows a hacker to modify the file system of the container.

The vulnerability of the SINEC Traffic Analyzer software for monitoring and analyzing network traffic in industrial networks is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to modify the file system of the container remotely...

CVE-2024-11215

Absolute path traversal incorrect restriction of a path to a restricted directory vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only...

The vulnerability of the containers-common library in the Golang programming language arises from improper resolution of references before accessing files. This allows attackers to gain access to confidential information.

The vulnerability of the containers-common library in the Golang programming language is related to improper resolution of references before accessing files. Exploiting this vulnerability can allow an attacker to gain access to confidential information by using symbolic references, by mounting...

SAP NetWeaver AS ABAP Information Disclosure (3508947)

SAP NetWeaver Application Server for ABAP is affected by information disclosure vulnerability: - SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web...

HPESBUX04744 rev.1 - HP-UX Using OpenSSL, Multiple Local and Remote Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Unauthorized Access to Files, Buffer Overflow; Remote: Denial of Service DoS, Unauthorized Access to Files, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX OpenSSL Software - Prior to A.03.00.15.001 CVS...

Medium: nodejs20

Issue Overview: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actor...

PT-2024-16833

Name of the Vulnerable Software and Affected Versions EasyPHP version 14.1 Description The issue is an absolute path traversal vulnerability, which could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server. This is achieved by setting consecutive...

CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

CVE-2024-49504

CVE-2024-49504 is referenced in multiple security advisories for grub2 (GRUB2) across EulerOS and Tencent/TencentOS Server ecosystems. The linked Nessus/OPENVAS entries identify that “grub2 allowed attackers with access to the grub shell to access files on the encrypted disks,” indicating a vulne...

Files or Directories Accessible to External Parties

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties by abusing the mail notification template via the dataUrl function. Note: This is only exploitable when the attacker have write permissions...

Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Summary A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads,...

CVE-2024-48838

Dell SmartFabric OS10 vulnerability CVE-2024-48838 affects OS10: Dell SmartFabric OS10 Software versions 10.5.3.x–10.5.6.x. The issue is described as files or directories accessible to external parties, enabling a low-privileged, locally authenticated attacker to potentially gain filesystem acces...

PT-2024-8513 · Microsoft · Pcmanager

Name of the Vulnerable Software and Affected Versions: Microsoft PC Manager affected versions not specified Description: The issue is related to an incorrect handling of symbolic links before accessing a file, which can be exploited to elevate privileges. Recommendations: At the moment, there is ...

PT-2024-39089 · Unknown · Modelscope/Agentscope

Name of the Vulnerable Software and Affected Versions: modelscope/agentscope version v0.0.4 Description: A Local File Inclusion LFI vulnerability exists in the "/load-workflow" endpoint, allowing an attacker to read arbitrary files from the server, including sensitive files such as API keys, by...

DEBIAN-CVE-2024-51747

Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its path entry in the projecthasfiles SQLite db...

Cisco Identity Services Engine Path Traversal Vulnerability (CNVD-2025-06672)

Cisco Identity Services Engine is an environment-aware platform from Cisco, USA. A path traversal vulnerability exists in Cisco Identity Services Engine that can be exploited by an attacker to read or delete arbitrary files...

Cisco Identity Services Engine Path Traversal Vulnerability (CNVD-2025-06671)

Cisco Identity Services Engine is an environment-aware platform from Cisco, USA. A path traversal vulnerability exists in Cisco Identity Services Engine that can be exploited by an attacker to read or delete arbitrary files...

Path Traversal

werkzeug is vulnerable to Path Traversal. The vulnerability is due to inadequate handling of UNC paths in the os.path.isabs function, which results in safejoin not properly validating the path, allowing an attacker to manipulate the path and gain unauthorized access to files or directories...

CVE-2024-51998

CVE-2024-51998 affects changedetection.io. The vulnerability arises from improper validation of the file:// URI scheme when a webdriver is enabled and ALLOW_FILE_URI is false or unset, allowing an attacker to read arbitrary files on the host. The root cause is that is_safe_url accepts file: schem...