GHSA-2444-8GJ8-6FMX Magento Open Source allows XML Injection

Adobe Commerce versions 2.4.4-p2 and earlier and 2.4.5-p1 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of thi...

DEBIAN-CVE-2023-0778

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

AZL-43612 CVE-2023-0778 affecting package podman 4.1.1-26

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

AZL-45381 CVE-2023-0778 affecting package podman for versions less than 5.6.1-2

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

CVE-2023-0778

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

UBUNTU-CVE-2023-0778

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

Design/Logic Flaw

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

CVE-2023-25817 Delete permissions are not saved when creating public share in Nextcloud server

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the...

CVE-2022-48350

CVE-2022-48350 concerns the Huawei Messaging app on HarmonyOS with a vulnerability described as unauthorized file access that can affect confidentiality. The NVD entry assigns CVSS v3.1: Network access, low attack complexity, no user interaction, no privileges required, with a High confidentialit...

PT-2023-15727 · Huawei · Huawei Messaging App

Name of the Vulnerable Software and Affected Versions: HUAWEI Messaging app affected versions not specified Description: The issue concerns unauthorized file access, which may impact confidentiality upon successful exploitation. Recommendations: At the moment, there is no information about a newe...

PT-2023-3011 · WordPress · Gravity Forms

Name of the Vulnerable Software and Affected Versions: Gravity Forms versions n/a through 2.7.3 Description: The issue is related to the deserialization of untrusted data in Gravity Forms, which can be exploited by a remote attacker to gain read, modify, or delete access to files or execute...

CVE-2022-48350

The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2022-48350

The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality...

Lavalite 9.0.0 Path Traversal

Exploit Title: Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal Exploit Author: nu11secur1ty Date: 09.29.2022 Vendor: https://lavalite.org/ Software: https://github.com/LavaLite/cms/releases/tag/v9.0.0 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite...

CVE-2023-0778

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

PT-2023-21449 · Apple · Macos Monterey +6

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 iOS versions prior to 16.4 iPadOS versions prior to 16.4 macOS Monterey versions prior to 12.6.4 tvOS versions prior to 16.4 macOS Big Sur versions prior to 11.7.5 Description: The issue allows an app to potential...

CVE-2023-0778

A Time-of-check Time-of-use TOCTOU flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system...

CVE-2023-27055

Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request...

mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

GHSA-XG73-94FP-G449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...