CVE-2024-31460

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in createallheadernodes function from lib/apiautomation.php , finally resulti...

CVE-2024-31441 Arbitrary File Reading in DataEase

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

CVE-2024-31441 Arbitrary File Reading in DataEase

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

CVE-2024-31441 Arbitrary File Reading in DataEase

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

CVE-2024-31441

DataEase (pre-1.18.19) is affected by an ARBITRARY FILE READ vulnerability due to lack of restrictions on ClickHouse connection parameters. An attacker can exploit certain malicious parameters to read arbitrary files. A fix is available in v1.18.19; upgrading to this version is recommended. Publi...

CVE-2024-31441

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

PT-2024-24078 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.19 Description: DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain...

PT-2024-25786

Name of the Vulnerable Software and Affected Versions CmsEasy version 7.7.7.9 Description A local file inclusion issue was discovered, allowing attackers to read arbitrary files via the file get contents function in the fetch action method of "/admin/template admin.php". Recommendations For CmsEa...

QNAP Systems 多款产品路径遍历漏洞

QNAP Systems QuTScloud and others are products of China's Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating syste...

CVE-2024-31841

An issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem...

CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...

PT-2024-23313 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is due to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the logo filename parameter in the...

CVE-2024-1511 Path Traversal Vulnerability in parisneo/lollms-webui

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various...

CVE-2024-3299

Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially...

CVE-2024-3298

Summary : CVE-2024-3298 affects Dassault Systèmes eDrawings in SOLIDWORKS 2023–2024. The vulnerability is an out-of-bounds write and type confusion in the file reading procedure when opening DWG/DXF files, as described in the initial entry and corroborated by related Red Hat CVEs. What’s affected...

SOLIDWORKS eDrawings 安全漏洞

SOLIDWORKS eDrawings is a SOLIDWORKS application for viewing and sharing CAD models from SolidWorks, Inc. A security vulnerability exists in SOLIDWORKS eDrawings versions 2023 through 2024, which stems from an out-of-bounds write and type confusion vulnerability during file reading...

Exploit for Improper Access Control in Adobe Coldfusion

Proof of Concept script for CVE-2024-20767 Overview get-...

CVE-2024-1848 Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024

Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024. These vulnerabilities...

CVE-2024-1848 Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024

Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024. These vulnerabilities...

PT-2024-25037 · Dassault Systèmes · Edrawings

Name of the Vulnerable Software and Affected Versions: eDrawings versions Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024 Description: The issue exists in the file reading procedure, allowing an attacker to execute arbitrary code while opening a specially crafted SLDDRW or SLDPRT file. Th...