Dell AppSync Server 代码问题漏洞

Dell AppSync Server is a copy data management software from Dell USA. An XML external entity injection vulnerability exists in Dell AppSync Server versions 4.3 through 4.6, which arises from a networked system or product that does not have the correct filters in place to allow references to...

CVE-2024-45290 Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided...

CVE-2024-9224

The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the helloworldlyric function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-9224

The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the helloworldlyric function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-9224 Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read

The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the helloworldlyric function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-9224

CVE-2024-9224 corresponds to the WordPress Hello World plugin (&lt;= v2.1.1) Arbitrary File Read. The vulnerability is triggered via the hello_world_lyric() function, allowing authenticated users with subscriber-level access or higher to read arbitrary server files containing sensitive informatio...

CVE-2024-9224: Improper Limitation of a Pathname to a Restricted Directory

The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the helloworldlyric function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

PT-2024-41092 · Netalertxnetalertx +3 · * +1

Name of the Vulnerable Software and Affected Versions: NetAlertX versions 24.7.18 through 24.10.12 Description: The issue allows unauthenticated file reading due to factors related to strpos and directory traversal, where an HTTP client can ignore a redirect. This is related to components/logs.ph...

Agnai File Disclosure Vulnerability: JSON via Path Traversal

CWE-35: Path Traversal https://cwe.mitre.org/data/definitions/35.html CVSSv3.1 4.3 - Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Summary A vulnerability has been discovered in Agnai that permits attackers to read arbitrary JS...

DataEase XML External Entity Injection Vulnerability

DataEase is a lightweight, high-performance self-service data visualization and analysis tool that helps users quickly explore and understand complex data, provides real-time data analysis and report generation capabilities, supports a variety of data sources, and is designed to improve data...

DataEase has an XML External Entity Reference vulnerability

Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: POST /de2api/staticResource/upload/1 HTTP/1.1 Host: dataease.ubuntu20.vm...

GHSA-4M9P-7XG6-F4MM DataEase has an XML External Entity Reference vulnerability

Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: POST /de2api/staticResource/upload/1 HTTP/1.1 Host: dataease.ubuntu20.vm...

CVE-2024-46985

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985: Improper Restriction of XML External Entity Reference

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

PortSwigger Web Security: cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party

The windmail.exe application in the CGI scripts wordlist had a vulnerability that allowed an attacker to read arbitrary files on the server and send the contents to a third-party email address...

PT-2024-32373

Name of the Vulnerable Software and Affected Versions czim/file-handling versions prior to 1.5.0 czim/file-handling versions 2.x prior to 2.3.0 Description The issue arises from improper validation of URLs within the makeFromUrl and makeFromAny functions, leading to Server-Side Request Forgery SS...