CVE-2024-22096 Relative Path Traversal in Rapid SCADA

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system...

CVE-2024-24756 Crafatar path traversal vulnerability

Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind Cloudflare including crafatar.com are not affected. Instances using the Docker container as shown in the READ...

CVE-2024-1167

When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur...

CVE-2024-1167 SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference

When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur...

CVE-2024-1167

CVE-2024-1167 affects SEW-EURODRIVE MOVITOOLS MotionStudio (affected: version 6.5.0.2) with an XML External Entity (XXE) processing flaw when handling SEWPROJ/XML data, leading to unrestricted file access within the process. Root cause: improper restriction of XML External Entity references (CWE-...

PT-2024-20534 · Crafatar · Crafatar

Name of the Vulnerable Software and Affected Versions: Crafatar versions prior to 2.1.5 Description: Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind...

SEW-EURODRIVE MOVITOOLS MotionStudio Code Issue Vulnerability

SEW-EURODRIVE MOVITOOLS MotionStudio is an engineering software from SEW-EURODRIVE. A security vulnerability exists in SEW-EURODRIVE MOVITOOLS MotionStudio version 6.5.0.2, which originates from the possibility of unrestricted file access when processing XML messages...

PT-2024-2073 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.15 Dataease versions prior to 2.3.0 Description: A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is...

CVE-2023-5390

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends...

Important: runc

Issue Overview: AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the...

Important: runc

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

PT-2024-1469 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge affected versions not specified Description: The issue is related to the loading of unsafe DLL libraries, which could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege...

PT-2024-1519 · Buildkit +3 · Buildkit +3

Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: The issue is related to a race condition that can occur when two malicious build steps run in parallel, sharing the same cache mounts with subpaths. This can lead to files from the host system...

BuildKit 竞争条件问题漏洞

BuildKit is concurrent, cache-efficient and Dockerfile-agnostic builder toolkit. A competitive condition issue vulnerability exists in BuildKit version v0.12.4 and prior versions, which stems from allowing access to files on the host system via build containers...

Path Traversal

aiohttp is vulnerable to Path Traversal. The vulnerability is due to faulty path validation which checks if the file being accessed is within the intended static root directory when followsymlinks = True. This allows an attacker to access files and directories outside the intended static root...

CVE-2023-4552

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This...

CVE-2023-4550

Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. Thi...

CVE-2023-4552 Java Database Connectivity (JDBC) URL Manipulation

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This...

CVE-2023-30970 Gotham table and Forward App Path traversal

Gotham Table service and Forward App were found to be vulnerable to a Path traversal issue allowing an authenticated user to read arbitrary files on the file system...

CVE-2024-1005

A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been...