15410 matches found
CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...
CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...
CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...
CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...
PT-2023-14110 · WordPress · Welcart E-Commerce
Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action availab...
Directory Traversal
github.com/go-aah/aah is vulnerable to directory traversal. The vulnerability exists in the Serve function in static.go due to improper santization of user input through HTTPEngine.Handle, which allows an attacker to read files outside of the target directory that the server has permission to rea...
CVE-2022-45874
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
CVE-2022-45874
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
Authorization
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
CVE-2022-4778
The CVE-2022-4778 entry concerns StreamX applications, specifically versions 6.02.01–6.04.34, affected by a path traversal vulnerability in the StreamView HTML component when the public web server feature is enabled. This allows authenticated users to access files on the server filesystem. Connec...
Goa vulnerable to path traversal
Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...
CVE-2022-45874
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
CVE-2022-45874
CVE-2022-45874 concerns Huawei Aslan Children’s Watch with an improper authorization vulnerability. Multiple sources (NVD, Red Hat, CNNVD, PRION, PT-Security, and Huawei PSIRT) describe that a successful exploit could allow access to certain files on the device. The Huawei advisory confirms the C...
CVE-2022-4778: Improper Limitation of a Pathname to a Restricted Directory
StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem. StreamX applications using StreamView HTML component with the public web server feature activated ar...
Huawei Aslan-AL10 安全漏洞
Huawei Aslan-AL10 is a children's smartwatch from Huawei China. The Huawei Aslan-AL10 suffers from a security vulnerability that stems from the presence of an improper authorization vulnerability that could allow an attacker to access specific files...
CVE-2022-45874: Improper Authorization
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
CVE-2022-45874
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file...
The vulnerability of the Malwarebytes antivirus protection lies in the incorrect handling of the link before accessing the file. This allows attackers to compromise the integrity and accessibility of the protected information.
The vulnerability of the Malwarebytes antivirus protection tool is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability allows a hacker to compromise the integrity and accessibility of the protected information through a specially created link...