CVE-2022-39296 Path traversal in MelisAssetManager

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of melisplatform/melis-asset-manager, leading to the disclosure of sensitive information. Conducting this attack does not require...

PT-2022-23469 · Seiko · Seiko Skybridge Mb-A200

Name of the Vulnerable Software and Affected Versions: Seiko SkyBridge MB-A200 versions 01.00.04 and below Description: The issue concerns multiple hard-coded passcodes for root access. Attackers can obtain these passcodes from /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh...

PT-2022-18353 · Sourcecodester · Sourcecodester Gym Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gym Management System affected versions not specified Description: A critical issue affects some unknown functionality of the file /mygym/admin/index.php. The manipulation of the edit tran argument leads to SQL injection. The...

PT-2022-7068 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader DC versions 17.012.30205 through 22.001.20085 Acrobat Reader DC versions 20.005.3031x and earlier Description: The issue is related to an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea...

Information Disclosure

opencast-common is vulnerable to Information Disclosure. The attack is possible because the library does not restrict the file access and authenticate against external services listed in a media package, leading to disclose the global system user's credentials to the outside cluster...

Insecure Access Control

github.com/containerd/containerd uses insecure access controls. Pulling of malicious image can cause Unix file permission changes for existing files in the host's file system. This can result in restriction of access to files which should otherwise by accessible...

CVE-2020-9968

CVE-2020-9968 is an Apple logic issue fixed in iOS 14.0/iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, and watchOS 7.0. A malicious application could access restricted files due to improved restrictions. Referenced Apple advisories HT211843, HT211844, and HT211850 corroborate the affected platfo...

ChurchCRM Software 3.3.2 Database Disclosure

Exploit Title : ChurchCRM Software 3.3.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/04/2019 Vendor Homepage : churchcrm.io Software Download Link : github.com/ChurchCRM/CRM/releases/download/3.3.2/ChurchCRM-3.3.2.zip Software...

CVE-2017-16787

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

CVE-2017-11177

TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory...

CVE-2017-11177

The CVE-2017-11177 issue affects TRITON AP-EMAIL: Websense TRITON AP-EMAIL 8.2 IB prior to version 8.2 suffers from improper file-access restriction in an unspecified directory. Affected component is the file access mechanism that allows unauthorized access to files, described across multiple sou...

Code injection

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system’s virtual hard disk driver stems from an improper restriction on access to files. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially created application...

CVE-2015-2748

CVE-2015-2748 affects Websense TRITON AP-WEB (and related Web Security/Explorer components) prior to version 8.0.0. The issue arises from failing to properly restrict access to the explorer_wse/ directory, allowing remote attackers to obtain sensitive information by directly requesting a Web Secu...

CVE-2014-2857

The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from...

CVE-2013-1717

CVE-2013-1717: Local-filesystem access via Java applets not properly restricted in Mozilla Firefox (before 23.0; ESR 17.x before 17.0.8), SeaMonkey (before 2.20), and Thunderbird (before 17.0.8). This allows user‑assisted reading of arbitrary files through downloads to fixed/predictable paths. Co...

CVE-2012-4906

Google Chrome for Android prior to version 18.0.1025308 is affected by CVE-2012-4906, where improper restriction of file: URLs allows remote attackers to obtain sensitive information via unspecified vectors (demonstrated by credential data access). The issue is distinct from CVE-2012-4903 and was...

rivettracker <=1.03 Multiple SQL injection

Exploit for php platform in category web applications Exploit Title: Multiple SQL injections in rivettracker =5.3.4 and backports we still have arbitary SQL queries but no config.php. config.php contai...

CVE-2010-3194

CVE-2010-3194 affects IBM DB2 via the DB2DART program. The vulnerability allows bypass of file access restrictions by overwriting files owned by the instance owner in DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2. The initial description notes bypass via unspecified vectors related to ov...

CVE-2008-1834

Swfdec vulnerability CVE-2008-1834 affects Swfdec up to version before 0.6.4. The flaw is in swfdec_load_object.c, which does not properly restrict local file access from untrusted sandboxes, enabling a crafted Flash file to read arbitrary local files. Impact is described as partial confidentiali...