13983 matches found
CVE-2025-24974 DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available...
Path Traversal via Symbolic Links in `ObsidianReader`
Description The ObsidianReader class, designed to parse Obsidian vaults, contains a critical security flaw that allows arbitrary file read through symbolic links symlinks. When processing a vault, the reader does not resolve or validate the absolute paths of files, enabling an attacker to place a...
CVE-2025-0115 PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface web, SSH, console, or telnet and successfully authenticate to exploit this issue. You can greatly...
CVE-2025-0115 PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface web, SSH, console, or telnet and successfully authenticate to exploit this issue. You can greatly...
CVE-2025-0115
CVE-2025-0115 : A vulnerability in Palo Alto Networks PAN-OS allows an authenticated admin on the PAN-OS CLI to read arbitrary files. Exploitation requires network access to the management interface (web, SSH, console, or Telnet) and valid admin credentials. The issue does not affect Cloud NGFW o...
Webmin 1.580 Directory Traversal
Webmin version 1.580 proof of concept directory traversal exploit that leverages a vulnerability from 2012. ============================================================================================================================================= | Title : Webmin 1.580 Directory Traversal...
MENNEKES Charging column Smart 安全漏洞
MENNEKES Charging column Smart is a smart charging column from MENNEKES. A security vulnerability exists in MENNEKES Charging column Smart versions prior to 2.15, which originates from the ability to read arbitrary files...
CVE-2024-12036
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...
CVE-2025-26167
Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...
CVE-2024-48864
A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories. We have already fixed the vulnerability in the following versions: File Station 5...
CVE-2024-12036
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...
CVE-2024-12036
CVE-2024-12036 affects the WordPress CS Framework plugin (CS Framework) with Arbitrary File Read via get_widget_settings_json() in versions up to 6.9 (and tracked in later advisories as <= 7.1). The vulnerability requires at least subscriber-level authentication and allows reading arbitrary se...
CVE-2024-12036 CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...
CVE-2024-12036 CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...
Buffalo LinkStation Arbitrary File Read Vulnerability (Mar 2025) - Active Check
Buffalo LinkStation is prone to an arbitrary file read vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...
OpenPanel 0.3.4 Directory Traversal / Arbitrary File Read
OpenPanel version 0.3.4 suffers from a directory traversal vulnerability in the fix permission functionality. This can be leveraged to change permissions on files unaccessible to userland and make them accessible to attackers. Exploit Title: OpenPanel 0.3.4 - Insecure Permission Modification via...
WordPress CS Framework plugin <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read vulnerability
Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Tonn in WordPress Plugin CS Framework versions = 7.1...
CVE-2025-26167
Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files...
CVE-2025-27623
A flaw was found in Jenkins. Affected versions of Jenkins do not redact encrypted values of secrets when accessing the config.xml of views via REST API or CLI. This flaw allows attackers with view/read permission to view encrypted values of secrets...