1457 matches found
anything-llm 安全漏洞
anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. A security vulnerability exists in versions of anything-llm prior to 1.3.1, which stems from the multer library's mishandling of path traversal for non-ASCII filenames, which could lead to arbitrary file...
IBM App Connect Enterprise 路径遍历漏洞
IBM App Connect Enterprise is an operating system from International Business Machines IBM, Inc. that combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud native IBM App Connect Enterprise combines existing industry-trusted IBM...
CVE-2024-10313
iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or...
Path Traversal
Deep Java Library DJL is vulnerable to a Path Traversal. The vulnerability is due to insufficient validation of file paths in the ZipUtils.unzip and TarUtils.untar methods, allows an attacker to manipulate file paths, enabling them to write files to arbitrary locations on the system...
Sante PACS Server 路径遍历漏洞
Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. It is used to store, archive, manage, view and burn medical images. A path traversal vulnerability exists in...
PT-2025-4042
Name of the Vulnerable Software and Affected Versions FlightGear versions affected versions not specified Description An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level. Recommendations...
The vulnerability of the UserDataExchangeServiceClient::unpackVoiceTagArchiveOptimized() function in the Mercedes-Benz User Experience (MBUX) system allows a hacker to exploit it to elevate their privileges and record arbitrary files.
The vulnerability of the UserDataExchangeServiceClient::unpackVoiceTagArchiveOptimized function in the Mercedes-Benz User Experience MBUX system is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges and write arbitrary...
The vulnerability in the `-inc-recursive` configuration of the rsyncd daemon’s utility for transferring and synchronizing files allows a attacker to write arbitrary files.
The vulnerability of the -inc-recursive configuration of the rsyncd daemon, a utility for transferring and synchronizing files, involves traversing directory paths without checking for symbolic links, along with checks for duplication. Exploiting this vulnerability allows an attacker to write...
Unspecified Vulnerability in Selesta Visual Access Manager (CNVD-2025-22661)
Selesta Visual Access Manager is a visual access manager from Selesta. A security vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to write arbitrary files by manipulating the POST parameter of the page common/vamSql.php...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal when using the --safe-links option, due to a failure to properly verify if a symbolic link destination contains another symbolic link within it. Details A Directory Traversal attack also known as path traversal aims ...
The vulnerability of the App Connect Enterprise Certified Container management tool, related to unlimited resource distribution, allows a attacker to cause a service failure.
The vulnerability of the App Connect Enterprise Certified Container management tool is related to the unlimited distribution of resources during the process of writing files to the local file system. Exploiting this vulnerability can allow a attacker to cause service failures...
SUSE CVE-2024-56514
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...
PHPYun 安全漏洞
PHPYun is an efficient solution for talent and business recruitment and employment based on PHP and MySQL database by China Xinchao PHPYun. A security vulnerability exists in PHPYun versions prior to 7.0.2. An attacker can exploit the vulnerability to perform code execution via backdoor-restricte...
WordPress plugin WordPress File Upload 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...
GHSA-CWRH-575J-8VR3 Karmada Tar Slips in CRDs archive extraction
Impact What kind of vulnerability is it? Who is impacted? Both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resource definitionsCRDs needed by karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a...
CVE-2024-12687
Deserialization of Untrusted Data vulnerability in PlexTrac Runbooks modules which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1...
CVE-2024-12687 Insecure YAML Deserialization
Deserialization of Untrusted Data vulnerability in PlexTrac Runbooks modules which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1...
PlexTrac 安全漏洞
PlexTrac is a penetration test reporting and management platform from PlexTrac Inc. in the United States. A security vulnerability exists in PlexTrac version 1.61.3 through versions prior to 2.8.1, which stems from the presence of an untrusted data deserialization vulnerability that allows object...