166 matches found
CVE-2024-36427
The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...
CVE-2024-36427
The TARGIT Decision Suite (BI and analytics tool) contains a vulnerability in its file-serving function affecting versions prior to 24.06.19002 . Authenticated attackers can use a crafted file request to read or write arbitrary server files, which can lead to code execution via a .xview file . To...
CVE-2024-32982
Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...
GHSA-83PV-QR33-2VCF Litestar and Starlite vulnerable to Path Traversal
Summary Local File Inclusion via Path Traversal in LiteStar Static File Serving A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to...
CVE-2024-32982: Improper Limitation of a Pathname to a Restricted Directory
Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...
PT-2024-25030
Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.8.3 Litestar versions prior to 2.7.2 Litestar versions prior to 2.6.4 Description A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of Litestar, allowing attackers to...
BIT-MOODLE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
AZL-44319 CVE-2024-23334 affecting package python-aiohttp 3.6.2-3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
Cache Poisoning
moodle/moodle is vulnerable to Cache Poisoning. The vulnerability exists because the library does not impose any restrictions on the minimum value for a revision. If the revision is either too old or too new, the file content is cached without undergoing any validation through the file serving...
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
GHSA-CWH2-Q44X-5W3C Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
UBUNTU-CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
Design/Logic Flaw
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548
CVE-2023-5548 describes a Moodle-related issue where stronger revision number limitations on file serving endpoints are required to improve cache poisoning protection. The linked OSV/GHSA entries reiterate this root cause, framing it as a risk tied to how file endpoints handle revision data. The ...