CVE-2024-39379 Acrobat for Edge | Out-of-bounds Read (CWE-125)

Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that...

Weave 安全漏洞

Weave is a toolkit for developing generative AI applications open-sourced by Weights & Biases. Weave has a security vulnerability that stems from an API that allows a remote user to fetch files from a specific directory, leading to remote traversal and disclosure of arbitrary files...

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Description: Remote Code Execution Vulnerability has been identified in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL admidiobaseurl/admmyfiles/messagesattachments/filename. Th...

Unauthorized File Access

duckdb is vulnerable to Unauthorized File Access. The vulnerability is due to inadequate restrictions in the sniffcsv function, allowing access to the filesystem even when enableexternalaccess=false. Attackers can exploit this by reading content from files such as /etc/hosts and proc/self/environ...

Apache Drill XML External Entity Injection Vulnerability

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

GHSA-V62G-JWJ9-RFVX XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

CVE-2023-48362

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

Apache Drill 代码问题漏洞

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

USN-6911-1 nova vulnerability

Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access arbitrary files on the server, possibly exposing sensitive information...

CVE-2024-40767

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

OpenStack 安全漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack that stems from VMDK/qcow contains an arbitrary file access issue...

The vulnerability of the SCADA system MasterSCADA 4D, related to deficiencies in authentication procedures, allows a intruder to read and write arbitrary files.

The vulnerability of the SCADA system MasterSCADA 4D is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform read and write operations on arbitrary files...

The vulnerability of the CUPS printing server arises from incorrect handling of symbolic links before accessing files. This allows attackers to gain access to confidential data.

The vulnerability of the CUPS printing server is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to gain access to confidential data when running the cupsd server with the Listen configuration element...

The vulnerability of the Azure Network Watcher VM Extension for Windows operating systems allows a perpetrator to escalate their privileges.

The vulnerability of the Azure Network Watcher VM Extension for Windows operating systems stems from an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the PLUGScheduler component in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the PLUGScheduler component in Windows operating systems is related to an incorrect definition of the reference before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...

SolarWinds Access Rights Manager Path Traversal Vulnerability (CNVD-2024-34981)

SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A path traversal vulnerability exists in SolarWinds Access Rights Manager that can be exploited by an attacker to arbitrarily read and delete files in ARM...

SolarWinds Access Rights Manager Path Traversal Vulnerability (CNVD-2024-34987)

SolarWinds Access Rights Manager is a tool for managing and auditing user access rights. A path traversal vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to delete critical files or access sensitive data...

jenkins-2-plugins: git-server plugin arbitrary file read vulnerability

A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system...

CVE-2024-40617

Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 M2M-GW for FENICS. If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result,...