PT-2024-31399

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 2.2.1 Description The issue allows for a bypassing of a filter, enabling an XXE-attack. This attack can obtain contents of local files, even if error reporting is muted. Technical details about exploitation...

CVE-2024-6789 Path traversal in M-Files API

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files...

Rockwell Automation ThinManager ThinServer Privilege Management Error Vulnerability

Rockwell Automation ThinManager is the United States Rockwell Rockwell Automation a thin client management software. A privilege management error vulnerability exists in Rockwell Automation ThinManager ThinServer, which can be exploited by an attacker to submit a special request to read system fi...

The vulnerability of the extended Microsoft OfficePlus package arises from incorrect handling of symbolic links before accessing a file, allowing an attacker to exploit their privileges.

The vulnerability of the extended Microsoft OfficePlus package is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...

Exploit for File Descriptor Leak in Linuxfoundation Runc

CVE-2024-21626 Exploit Working Directory docker run -w...

CVE-2023-7260

Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files on the system...

CVE-2023-7260

Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4. The vulnerability could allow arbitrarily access files on the system...

CVE-2024-36440

Swissphone DiCal-RED 4009 devices are affected by CVE-2024-36440 due to use of unsalted MD5 for the administrative password. An attacker with access to /etc/deviceconfig can recover the admin password through password-cracking, exposing high confidentiality and integrity impact as noted in the CV...

OpenText CX-E Voice 安全漏洞

OpenText CX-E Voice is a voice application from OpenText Canada. A security vulnerability exists in OpenText CX-E Voice version 22.4 and prior versions that originates from allowing access to arbitrary files on the system...

PT-2024-15257

Name of the Vulnerable Software and Affected Versions OpenText CX-E Voice versions through 22.4 Description A Path Traversal vulnerability has been discovered, which could allow arbitrary access to files on the system. Recommendations For versions through 22.4, update to a version later than 22.4...

GO-2022-0584 Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad

Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad...

CVE-2023-49198

CVE-2023-49198 : Arbitrary file read in Apache SeaTunnel Web due to MySQL URL parameters (allowLoadLocalInfile, allowUrlInLocalInfile, allowLoadLocalInfileInPath, maxAllowedPacket). Affected: SeaTunnel 1.0.0; fix: upgrade to 1.0.1. Multiple connected sources corroborate the issue and remediation;...

CVE-2023-5505

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally,...

Adobe Commerce Path Traversal Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A path traversal vulnerability exists in Adobe Commerce. The vulnerability stems from the program failing to properly filter for specific elements in a...

Adobe Commerce Directory Traversal Vulnerability (CNVD-2024-44534)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from a directory traversal vulnerability that could be exploited by an attacker to access files and directories outside of a...

CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

The software’s vulnerability involves errors in PT Application Inspector, particularly regarding the incorrect handling of links before accessing files. This allows attackers to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the PT Application Inspector’s software for detecting vulnerabilities and errors is related to incorrect definition of the link before accessing a file. Exploiting this vulnerability allows an attacker to enhance their privileges and gain unauthorized access to protected...

Adobe Commerce 路径遍历漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A path traversal vulnerability exists in Adobe Commerce. The vulnerability stems from the program failing to properly filter for specific elements in a...