CVE-2020-36559 Path Traversal in aahframe.work

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2019-25073 Path traversal in github.com/goadesign/goa

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...

CVE-2022-45426

Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files...

aah 路径遍历漏洞

aah is a secure, flexible, and fast Go web framework from aah open source. aah suffers from a path traversal vulnerability that stems from incorrect categorization of user input. An attacker exploiting this vulnerability could read files outside of the target directory that the server is authoriz...

CVE-2019-13988

Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request aka Forced Browsing...

PT-2022-8092 · Sierra Wireless · Sierra Wireless Mgos

Name of the Vulnerable Software and Affected Versions: Sierra Wireless MGOS versions prior to 3.15.2 Sierra Wireless MGOS versions 4.x prior to 4.3 Description: The issue allows attackers to read log files via a Direct Request, also known as Forced Browsing. This can potentially expose sensitive...

CVE-2019-13988

Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request aka Forced Browsing...

Sierra Wireless MGOS 安全漏洞

Sierra Wireless MGOS is a wireless communication device from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless MGOS versions prior to 3.15.2 and versions prior to 4.x through 4.3, which stems from a vulnerability that allows an attacker to read log files via Direct Reques...

CVE-2021-39369: Improper Limitation of a Pathname to a Restricted Directory

In Philips formerly Carestream Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root...

CVE-2022-45894

GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files...

PT-2022-9021 · Modern Tribe · Modern Tribe Panel Builder Plugin

Name of the Vulnerable Software and Affected Versions: Modern Tribe Panel Builder Plugin affected versions not specified Description: A critical vulnerability has been found in the Modern Tribe Panel Builder Plugin, affecting the add post content filtered to search sql function of the...

The vulnerability of the decon_set_win_config() function in the Display and Enhancement Controller (DECON) driver of the Display Processing Unit (DPU) for Android mobile devices from Samsung allows a malicious actor to gain access to read, modify, or delete files, or to cause a service failure.

The vulnerability of the deconsetwinconfig function in the Display and Enhancement Controller DECON driver of the Display Processing Unit DPU for Android mobile devices from Samsung relates to the use of memory after it is freed during the processing of file descriptors. Exploiting this...

The vulnerability of the Android operating system’s exchange buffer in Samsung mobile devices allows a hacker to gain access to read, modify, or delete files.

The vulnerability of the exchange buffer in Android mobile devices from Samsung is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete files...

CVE-2022-43857

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

CVE-2022-43857 IBM Navigator for i information disclosure

IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force I...

CVE-2022-28283: Files or Directories Accessible to External Parties

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox 99...

CVE-2022-28283

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox 99...

CVE-2022-38708

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack SSRF attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180...

CVE-2022-40607 IBM Spectrum Scale directory traversal

IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740...

CVE-2022-4107

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...