3622 matches found
Information disclosure
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...
CVE-2023-50449
JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...
Apache Cocoon XML External Entity Injection Vulnerability
Apache Cocoon is the United States Apache Apache Foundation of a component-based Web development concepts built Web application framework. Apache Cocoon suffers from an XML External Entity Injection vulnerability that arises from a network system or product that does not have the correct filters ...
CVE-2023-38879
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'...
CVE-2023-42783
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests...
Siemens OPC UA Modelling Editor 安全漏洞
Siemens OPC UA Modeling Editor SiOME is a free tool to create OPC UA information models or map existing companion specifications. An XML external entity injection vulnerability exists in Siemens OPC UA Modeling Editor SiOME, which can be exploited by an attacker to interfere with the application'...
QNAP Systems Music Station Path Traversal Vulnerability
QNAP Systems Music Station is a music playback and management application from QNAP Systems. QNAP Systems Music Station suffers from a path traversal vulnerability that stems from the presence of a path traversal vulnerability that could allow a user to read the contents of an unexpected file and...
MCL Technologies MCL-Net vulnerable to directory traversal
Overview Server software "MCL-Net" provided by MCL Technologies contains a directory traversal vulnerability CWE-22, CVE-2023-4990. Panasonic reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact Arbitrary files on the server may be read by an attacker...
CVE-2023-41040
A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...
Arbitrary file reading vulnerability in icc Intelligent Internet of Things Integrated Management Platform of Zhejiang Dahua Technology Co.
Zhejiang Dahua Technology Co., Ltd. is a leading supplier and solution provider of surveillance products. Zhejiang Dahua Technology Co., Ltd. icc Intelligent IOT Integrated Management Platform There is an arbitrary file reading vulnerability, which can be exploited by attackers to obtain sensitiv...
Path traversal
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the files have certain extensions txt, swf...
CVE-2023-46864
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...
IDAttend IDWeb Security Vulnerabilities
IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in the IDAttend IDWeb application version 3.1.013, which originates from unauthenticated arbitrary file reading...
CVE-2023-37532
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system...
Design/Logic Flaw
WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings...
CVE-2023-4990
Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package P01 may allow attackers to read arbitrary files...
PT-2023-28280 · Unknown · Application
Name of the Vulnerable Software and Affected Versions: FD Application versions 9.01 and earlier Description: The issue improperly restricts XML external entity references XXE, allowing an attacker to read arbitrary files on the system by processing a specially crafted XML file. Recommendations: F...
CVE-2023-41968
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read arbitrary files...
openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0259-1)
The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0259-1 advisory. - GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the .git...
