CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

PT-2023-14110 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action availab...

Directory Traversal

github.com/go-aah/aah is vulnerable to directory traversal. The vulnerability exists in the Serve function in static.go due to improper santization of user input through HTTPEngine.Handle, which allows an attacker to read files outside of the target directory that the server has permission to rea...

CVE-2022-45874

Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...

CVE-2022-45874

Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...

Authorization

Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...

CVE-2022-4778

The CVE-2022-4778 entry concerns StreamX applications, specifically versions 6.02.01–6.04.34, affected by a path traversal vulnerability in the StreamView HTML component when the public web server feature is enabled. This allows authenticated users to access files on the server filesystem. Connec...

Goa vulnerable to path traversal

Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...

CVE-2022-45874

Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...

CVE-2022-45874

CVE-2022-45874 concerns Huawei Aslan Children’s Watch with an improper authorization vulnerability. Multiple sources (NVD, Red Hat, CNNVD, PRION, PT-Security, and Huawei PSIRT) describe that a successful exploit could allow access to certain files on the device. The Huawei advisory confirms the C...

Huawei Aslan-AL10 安全漏洞

Huawei Aslan-AL10 is a children's smartwatch from Huawei China. The Huawei Aslan-AL10 suffers from a security vulnerability that stems from the presence of an improper authorization vulnerability that could allow an attacker to access specific files...

CVE-2022-45874

Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...

The vulnerability of the Malwarebytes antivirus protection lies in the incorrect handling of the link before accessing the file. This allows attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of the Malwarebytes antivirus protection tool is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability allows a hacker to compromise the integrity and accessibility of the protected information through a specially created link...

CVE-2019-25073

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...

CVE-2020-36559

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2020-36559 Path Traversal in aahframe.work

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2019-25073 Path traversal in github.com/goadesign/goa

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...