14600 matches found
CVE-2024-0440
Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files...
CVE-2024-22988
ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp...
GHSA-WFM3-GQ9H-MRJM Appwrite Directory Traversal vulnerability
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...
Backstage Security Vulnerabilities
Backstage is a software application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage backend-common, which stems from insufficiently detailed path checking using "resolveSafeChildPath". The vulnerability can be exploited to access files a...
FreeIPA 4.10.1 Denial Of Service / Information Disclosure
Summary: Specially crafted HTTP requests can read files in the DC server. And use keytab files for authorization for different kerberos principals. Tested FreeIPA version: ipa-server-4.10.1 Details The "user" parameter in the HTTP URI "/sip/session/loginpassword" is inserted into the "run" functi...
Cross-site Scripting in Pyhtml2pdf
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
Cross-site Scripting in electron-pdf
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1647
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1648
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
PYSEC-2024-301
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1647
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1648
CVE-2024-1648 affects electron-pdf 20.0.0. The vulnerability stems from the application not validating user-supplied HTML content, enabling a remote attacker to read arbitrary local files. Root cause identified as improper HTML content validation. Impact is described as remote local-file access; ...
CVE-2024-1648 electron-pdf 20.0.0 - Local File Read via Server Side XSS
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
Pyhtml2pdf Cross-Site Scripting Vulnerability
Pyhtml2pdf is a simple python wrapper from the Python Foundation. Convert HTML to PDF using headless Chrome via selenium. A cross-site scripting vulnerability exists in Pyhtml2pdf version 0.0.6, which stems from not validating user-entered HTML content, resulting in an attacker being able to obta...
CVE-2024-1647
CVE-2024-1647 affects Pyhtml2pdf 0.0.6. The vulnerability arises from not validating user-provided HTML content, allowing an external attacker to remotely read arbitrary local files via a server-side XSS path. Impact is described as local file access with high confidentiality impact; CVSS: NETWOR...
CVE-2023-52370
Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access...
CVE-2023-52370
CVE-2023-52370 is a stack overflow vulnerability in the network acceleration module that can lead to unauthorized file access. The NVD entry assigns a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts ...
Huawei EMUI 安全漏洞
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A privilege checking type vulnerability exists in the...
GHSA-8H4X-XVJP-VF99 Hazelcast Platform permission checking in CSV File Source connector
Impact In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem. Patches Fix...
