CVE-2024-41169 Apache Zeppelin: raft directory listing and file read

The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removin...

CVE-2024-41169

The CVE concerns Apache Zeppelin (versions 0.10.1–0.12.0) where an unauthenticated raft server protocol can expose server resources, including directories and files. Root cause details in connected data indicate the raft-enabled components allow unauthenticated access, enabling an attacker to vie...

CVE-2025-7518 RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read

The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the getlocalfilename function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server...

CVE-2025-7518

CVE-2025-7518 affects the WordPress RSFirewall! plugin. A path traversal vulnerability exists in versions through 1.1.42 via the get_local_filename() function, allowing authenticated attackers with Administrator-level access and above to read arbitrary server files. Impact is unauthorized disclos...

CVE-2025-7518 RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read

The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the getlocalfilename function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server...

BIT-KAFKA-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url"...

CVE-2023-39339

A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request...

CVE-2023-39339

A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request...

CVE-2023-39339

A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request...

CVE-2023-39339

A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request...

CVE-2023-39339

Ivanti Policy Secure (IPS) vulnerability CVE-2023-39339 affects all IPS versions prior to 22.6R1. An authenticated administrator can perform an arbitrary file read via a specially crafted web request. Impact is confidentiality (high) with no impact to integrity or availability reported; credentia...

Ivanti Policy Secure 安全漏洞

Ivanti Policy Secure IPS is a network access control NAC solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Policy Secure IPS versions prior to 22.6R1 that originates from an authenticated administrator being able to perform arbitrary file reads via a specially craft...

CVE-2025-7401

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remotetunnel.php in all versions up to, and including, 3.0.2. This makes it possible for...

CVE-2025-7401

The CVE-2025-7401 entry concerns the Premium Age Verification / Restriction for WordPress plugin (vulnerable up to 3.0.2). A remote_tunnel.php endpoint with insufficient access protection enables unauthenticated attackers to read from and write to arbitrary files on the affected site’s server, po...

CVE-2025-7401 Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remotetunnel.php in all versions up to, and including, 3.0.2. This makes it possible for...

CVE-2025-34098

The CVE-2025-34098 entry describes a path traversal vulnerability in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) where improper input validation in the log filtering functionality exposed via the management web interface allows an authenticated attacker to submit crafted filte...

CVE-2025-34098 Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injection

A path traversal vulnerability exists in Riverbed SteelHead VCX appliances confirmed in VCX255U 9.6.0a due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter...

Exploit for CVE-2024-27954

CVE-2024-27954 - WordPress wp-automatic Plugin LFI Scanner Th...

curl: Arbitrary File Read via file:// Protocol in cURL

cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...

PT-2025-28950 · Ruckus +1 · Smartzone +2

Name of the Vulnerable Software and Affected Versions: RUCKUS SmartZone SZ versions prior to 6.1.2p3 Refresh Build Description: RUCKUS SmartZone SZ is susceptible to an OS command injection issue through a specific parameter within an API route. Recommendations: Update RUCKUS SmartZone SZ to...