15410 matches found
CVE-2022-42188
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server...
PT-2022-24703 · Unknown · Rava Certificate Validation System
Name of the Vulnerable Software and Affected Versions: RAVA certification validation system affected versions not specified Description: The RAVA certification validation system has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and access arbitrar...
CVE-2021-22685
An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1...
CVE-2021-22685
The CVE-2021-22685 issue is a path-traversal vulnerability in Cassia Networks Access Controller prior to version 2.0.1. The flaw allows an attacker to use the minify route with a relative path to view arbitrary server files, potentially exposing sensitive data. Affected product: Cassia Networks A...
CVE-2021-22685: Improper Limitation of a Pathname to a Restricted Directory
An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1...
CVE-2022-40777
Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveyssubmit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550...
Heartex Label Studio Server-Side Request Forgery Vulnerability
Label Studio is an open source data labeling tool from Heartex. Heartex Label Studio Community Edition 1.5.0 and previous versions contain a server-side request forgery vulnerability that stems from a failure to properly validate user input in the data import module, which could be exploited by a...
CVE-2022-39296 Path traversal in MelisAssetManager
MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...
VMware vRealize Operations 安全漏洞
VMware vRealize Operations is an application from VMware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A security vulnerability exists in VMware vRealize Operations. An attacker exploiting the vulnerabilit...
PT-2022-25262 · Siemens · Desigo Pxm40-1 +9
Name of the Vulnerable Software and Affected Versions: Desigo PXM30-1 versions prior to V02.20.126.11-41 Desigo PXM30.E versions prior to V02.20.126.11-41 Desigo PXM40-1 versions prior to V02.20.126.11-41 Desigo PXM40.E versions prior to V02.20.126.11-41 Desigo PXM50-1 versions prior to...
WordPress plugin Download Monitor 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
EulerOS 2.0 SP10 : curl (EulerOS-SA-2022-2413)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl 7.84.0 stores all of them. A sufficientl...
Rdiffweb 路径遍历漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your files through an efficient web interface. A path traversal vulnerability exists in Rdiffweb versions prior to 2.4.10, which stems from a vulnerability that allows an attacker to...
The vulnerability of the LibXfont library lies in the improper definition of symbolic links before accessing the file, allowing attackers to trigger a service failure.
The vulnerability of the LibXfont library is related to the incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability allows an attacker to cause service failures...
Design/Logic Flaw
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...
CVE-2022-3287
When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...
UBUNTU-CVE-2022-39261
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outsi...
Path traversal
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete...
PT-2022-25402 · Tp Link · Tp Link Archer Ax10
Name of the Vulnerable Software and Affected Versions: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 Description: The issue allows authenticated attackers to execute arbitrary code via a crafted backup file. Recommendations: For TP Link Archer AX10 V1 Firmware Versio...
VulnCheck KEV: CVE-2012-4867
Directory traversal vulnerability in modules/comvtigerworkflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. dot dot in the modulename parameter...