CVE-2023-7307

CVE-2023-7307 affects Sangfor Behavior Management System (DC Management System). The vulnerability is an XML external entity (XXE) injection in the /src/sangforindex endpoint caused by improper XML parser configuration, allowing a remote, unauthenticated attacker to submit crafted XML that can di...

Sangfor Behavior Management System 安全漏洞

Sangfor Behavior Management System is a behavior management software from China-based Sangfor. A security vulnerability exists in the Sangfor Behavior Management System that stems from an improperly configured XML parser, which could lead to internal file disclosure or server-side request forgery...

Linux Distros Unpatched Vulnerability : CVE-2018-1048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOWENCODEDSLASH option and thus allow the the slash /...

CVE-2023-7307: Improper Restriction of XML External Entity Reference

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

The vulnerability of the Spring Framework lies in the lack of handling of CRLF sequences in HTTP headers (or “HTTP response splitting”). This allows attackers to carry out the RFD attack.

The vulnerability of the Spring Framework is related to the failure to handle CRLF sequences in HTTP headers or “HTTP response splitting”. Exploiting this vulnerability allows an attacker to perform a RFD attack by utilizing the “Content-Disposition” header...

Linux Distros Unpatched Vulnerability : CVE-2021-40690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the secureValidation property is not passed...

CVE-2025-8562: Improper Limitation of a Pathname to a Restricted Directory

The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can...

Linux Distros Unpatched Vulnerability : CVE-2017-5595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to...

CVE-2025-43758: Files or Directories Accessible to External Parties

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users guests to access via URL files...

vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

GHSA-PP7P-Q8FX-2968 vite-plugin-static-copy files not included in `src` are possible to access with a crafted request

Summary Files not included in src was possible to access with a crafted request. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Arbitrary files can be disclosed by exploiting this vulnerability. Details Consider the...

PT-2025-34242 · Vite · Vite-Plugin-Static-Copy

Name of the Vulnerable Software and Affected Versions: vite-plugin-static-copy versions prior to 2.3.2 vite-plugin-static-copy versions prior to 3.1.2 Description: The vite-plugin-static-copy plugin for Vite allows access to files not included in the src directory through a crafted request. This...

XML External Entity (XXE) Injection

Overview org.apache.tika:tika-parsers is a toolkit for detecting and extracting metadata and structured text content from various documents using existing parser libraries. Affected versions of this package are vulnerable to XML External Entity XXE Injection. An attacker can access sensitive...

CVE-2025-43749: Files or Directories Accessible to External Parties

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users guests to access via URL files...

Linux Distros Unpatched Vulnerability : CVE-2018-1047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +23 more potentially affected by CVE-2025-55303 via astro (>=5.0.0-beta.5, <=5.12.8)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.0.1, =1.25.426-4, =0.6.2, =0.0.0-dev-20250414184926, =0.0.1, =0.0.1, =0.0.1, =2.1.22, =1.0.3, =0.1.0, =0.4.2 and more Source cves: CVE-2025-55303 Source advisory: OSV:GHSA-XF8X-J4P2-F749...

Linux Distros Unpatched Vulnerability : CVE-2023-3823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables...

WeGIA 路径遍历漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A path traversal vulnerability exists in WeGIA versions prior to 3.4.8, which stems from a path traversal in the /html/socio/sistema/downloadremessa.php endpoint that could lead to a local file disclosure...

Linux Distros Unpatched Vulnerability : CVE-2020-12392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user...

BIT-LIBPHP-2023-3823 Security issue with external entity loading in XML without enabling it

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling...