14581 matches found
GHSA-V62G-JWJ9-RFVX XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...
CVE-2023-48362
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...
Apache Drill 代码问题漏洞
Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...
USN-6911-1 nova vulnerability
Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information...
CVE-2024-40767
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced...
qemu-kvm: 'qemu-img info' leads to host file read/write
A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...
OpenStack 安全漏洞
OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack that stems from VMDK/qcow contains an arbitrary file access issue...
The vulnerability of the SCADA system MasterSCADA 4D, related to deficiencies in authentication procedures, allows a intruder to read and write arbitrary files.
The vulnerability of the SCADA system MasterSCADA 4D is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform read and write operations on arbitrary files...
The vulnerability of the CUPS printing server arises from incorrect handling of symbolic links before accessing files. This allows attackers to gain access to confidential data.
The vulnerability of the CUPS printing server is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to gain access to confidential data when running the cupsd server with the Listen configuration element...
The vulnerability of the Azure Network Watcher VM Extension for Windows operating systems allows a perpetrator to escalate their privileges.
The vulnerability of the Azure Network Watcher VM Extension for Windows operating systems stems from an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the PLUGScheduler component in Windows operating systems allows a hacker to increase their privileges.
The vulnerability of the PLUGScheduler component in Windows operating systems is related to an incorrect definition of the reference before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...
SolarWinds Access Rights Manager Path Traversal Vulnerability (CNVD-2024-34981)
SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A path traversal vulnerability exists in SolarWinds Access Rights Manager that can be exploited by an attacker to arbitrarily read and delete files in ARM...
SolarWinds Access Rights Manager Path Traversal Vulnerability (CNVD-2024-34987)
SolarWinds Access Rights Manager is a tool for managing and auditing user access rights. A path traversal vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to delete critical files or access sensitive data...
jenkins-2-plugins: git-server plugin arbitrary file read vulnerability
A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system...
CVE-2024-40617
Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 M2M-GW for FENICS. If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result,...
IBM Datacap Navigator Path Traversal Vulnerability
IBM Datacap Navigator is a Web client for Datacap from International Business Machines IBM. IBM Datacap Navigator suffers from a path traversal vulnerability that can be exploited by an attacker to view arbitrary files on the system via a specially crafted URL request...
The vulnerability of the Atlassian Bamboo continuous integration system lies in the improper elimination of special elements in the output data, allowing attackers to gain access to local server files and execute them.
The vulnerability of the Atlassian Bamboo continuous integration system is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to gain access to local server files and execute them...
PT-2024-4767 · Atlassian · Bamboo
Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo Data Center and Server versions 9.0.0 through 9.6.0 Description: The issue is related to a File Inclusion vulnerability that allows an authenticated attacker to display the contents of a local file or execute different files...
Security Bulletin: Multiple vulnerabilities in libcURL affect IBM DevOps Code ClearCase.
Summary libcURL vulnerabilities were disclosed by the libcURL Project. libcURL is used by IBM DevOps Code ClearCase. CVE-2023-46219, CVE-2023-46218 Vulnerability Details CVEID:CVE-2023-46219 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw...
