CVE-2024-29502

An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...

CVE-2024-1728 Local File Inclusion in gradio-app/gradio

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...

Inteset Systems Secure Lockdown 安全漏洞

Inteset Systems Secure Lockdown is a Windows lockdown utility from Inteset Systems, Inc. Allows access to only desired applications from a highly customizable menu. A security vulnerability exists in Inteset Systems Secure Lockdown version v2.00.219, which stems from a vulnerability that allows a...

PT-2024-22928 · Unknown · Secure Lockdown Multi Application Edition

Name of the Vulnerable Software and Affected Versions: Secure Lockdown Multi Application Edition version 2.00.219 Description: An issue in the software allows attackers to read arbitrary files via using UNC paths. Recommendations: For Secure Lockdown Multi Application Edition version 2.00.219,...

PT-2024-18161 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: A Local File Inclusion LFI vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this...

Arbitrary file read on endpoint

...

PT-2024-18308 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: WordPress Infinite Scroll – Ajax Load More plugin for WordPress versions up to, and including, 7.0.1 Description: The issue allows authenticated attackers with administrator-level access and above to read the contents of arbitrary files on th...

CLSA-2024-1712263970 kernel: Fix of 48 CVEs

bpf: Fix re-attachment branch in bpftracingprogattach CVE-2024-26591 - ext4: improve error recovery code paths in ext4remount CVE-2024-0775 - smb: client: fix OOB in receiveencryptedstandard CVE-2024-0565 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - net:...

Arbitrary File Read

github.com/canonical/pebble is vulnerable to a Arbitrary File Read. The vulnerability is due to the read-file API and the associated pebble pull command, allowing unprivileged local users to access files with root-equivalent permissions when Pebble is operating as root...

Security Bulletin: Vulnerabilities have been identified with the DS8900F Hardware Management Console (HMC)

Summary The updates indicated below have been released to address the following vulnerabilities: CVE-2023-46169 Arbitrary file deletion, CVE-2023-46171 view sensitive log information, CVE-2023-46172 Bypass authentication restrictions for authorized user, CVE-2023-46170 Arbitrary file read ,...

Metasploit Weekly Wrap-Up 04/05/2024

New ESC4 Templates for AD CS Metasploit added capabilities for exploiting the ESC family of flaws in AD CS in Metasploit 6.3. The ESC4 technique in particular has been supported for some time now thanks to the adcscerttemplates module which enables users to read and write certificate template...

CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...

CVE-2024-31220

Sunshine (Moonlight’s self-hosted game stream host) is affected by a path-traversal bug that allows remote reading of arbitrary files without authentication in versions 0.16.0 through 0.17.x. An attacker could trigger the issue by sending an HTTP/S request to the node_modules endpoint if the Suns...

CVE-2024-31220 Sunshine vulnerable to remote unauthenticated arbitrary file read

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface...

Jasmin Ransomware 1.1 Arbitrary File Read

Exploit Title: Jasmin Ransomware arbitrary file read Date: 2024-04-04 Exploit Author: @chebuya Software Link: https://github.com/codesiddhant/Jasmin-Ransomware Version: v1.1 Tested on: Ubuntu 20.04 LTS CVE: CVE-2024-30851 Description: Jasmin Ransomware panel contains multiple SQL injections and...

Visual Planning 8 Arbitrary File Read

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Title ===== SCHUTZWERK-SA-2023-006: Arbitrary File Read via XML External Entities in Visual Planning Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2023-49234 Link ====...

PT-2024-23862 · Sunshine · Sunshine

Name of the Vulnerable Software and Affected Versions: Sunshine versions 0.16.0 through 0.17.x Description: Sunshine is a self-hosted game stream host for Moonlight. An attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who...

CVE-2024-3250

It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2,...

The vulnerability of the function in the out-of-band connection of the Cisco Nexus Dashboard Fabric Controller (NDFC) allows a hacker to read arbitrary files on the server.

The vulnerability of the out-of-band connection function of the Cisco Nexus Dashboard Fabric Controller NDFC exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary files on the server...

PT-2024-21957 · Inotec Sicherheitstechnik · Inotec Sicherheitstechnik Webserver Cps220/64

Name of the Vulnerable Software and Affected Versions: INOTEC Sicherheitstechnik WebServer CPS220/64 version 3.3.19 Description: The issue allows a remote attacker to read arbitrary files via absolute path traversal. For example, using the "/cgi-bin/display?file=/etc/passwd" URI, an attacker can...