Files or Directories Accessible to External Parties

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition...

CVE-2021-26639

CVE-2021-26639 affects WISA Smart Wing CMS. The vulnerability arises from insufficient input validation in specific functions, allowing remote attackers to leak all files on the server without authentication. Reported details consistently describe unauthorized file disclosure as the impact. No co...

GSD-2022-1003761 drivers/base/node.c: fix compaction sysfs file leak

drivers/base/node.c: fix compaction sysfs file leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

SUSE-SU-2022:1932-1 Security update for patch

This update for patch fixes the following issues: Security fixes: - CVE-2019-13636: Fixed mishandled following of symlinks in certain cases other than input files bsc1142041. - CVE-2018-6952: Fixed double free of memory in pch.c:anotherhunk bsc1080985. Bugfixes: - Pass the correct stat to backup...

SUSE-SU-2022:1888-1 Security update for helm-mirror

This update for helm-mirror fixes the following issues: - Updated to version 0.3.1: - CVE-2019-18658: Fixed a potential symbolic link issue in helm that could be used to leak sensitive files bsc1156646...

CVE-2022-24730 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository acces...

CVE-2021-43734

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host...

CVE-2021-43734

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host...

CVE-2021-43734

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host...

CVE-2021-43734

CVE-2021-43734 affects kkFileview v4.0.0 and is a Local File Inclusion via a directory traversal that may lead to sensitive file leaks on the host. The Nuclei template details an LFI impact with high severity (CVSSv3.1: 7.5) and indicates remediation by upgrading to v4.0.1 or later. Other sources...

CVE-2021-44557

National Library of the Netherlands multiNER = c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity XXE vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS...

CVE-2021-44556

National Library of the Netherlands digger 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity XXE vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS...

CVE-2021-44556

National Library of the Netherlands digger 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity XXE vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS...

Nextcloud: Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app

Summary: The Android client of nextcloud com.nextcloud.client allows arbitrary file including protected/private files to be leaked through the file upload functionality. Steps To Reproduce: A report 1142918 has been submitted for the vulnerability of leaking arbitrary protected files. NextCloud...

CVE-2021-3800

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition...

TryGhost express-hbs information disclosure vulnerability

TryGhost express-hbs is an Express handlebar template engine with multiple layouts, blocks and cache sections. tryGhost express-hbs suffers from an information disclosure vulnerability that stems from the product's Express render API mixing pure template data with engine configuration options,...

FortiProxy - system file leak through SSL VPN special crafted HTTP resource requests

A path traversal vulnerability in the FortiProxy SSL VPN web portal may allow a non-authenticated, remote attacker to download FortiProxy system files through specially crafted HTTP resource requests...

CVE-2020-35580

Summary: CVE-2020-35580 is a local file inclusion vulnerability in the SearchBlox FileServlet (versions before 9.2.2). The issue allows remote, unauthenticated attackers to read arbitrary files from the OS (via /searchblox/servlet/FileServlet?col=url=) and may expose the SearchBlox configuration ...

Grafana 输入验证错误漏洞

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A security vulnerability exists in Grafana Enterprise Metrics versions prior to 1.2.1...

CVE-2020-14339

A flaw was found in libvirt, where it leaked a file descriptor for /dev/mapper/control into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of...