15410 matches found
CVE-2022-20822
Cisco Identity Services Engine (ISE) is affected via its web-based management interface. The root cause is insufficient validation of user-supplied input, enabling authenticated, remote attackers to read and delete files by sending crafted HTTP requests with path-sequence characters. Reported imp...
CVE-2022-31256
CVE-2022-31256 is a local privilege-escalation issue in the openSUSE/openSUSE Factory sendmail workflow. Affected component: a script invoked by the sendmail systemd service. Root cause: improper link resolution before file access ("link following") in that script allows a local attacker to escal...
CVE-2022-31256
A Improper Link Resolution Before File Access 'Link Following' vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1...
Delta Electronics InfraSuite Device Master 代码问题漏洞
Delta Electronics InfraSuite Device Master is a device used to simplify and automate the monitoring of critical devices from Delta Electronics Taiwan, China. The Delta Electronics InfraSuite Device Master suffers from a code issue vulnerability that stems from deserialization of untrusted data,...
CVE-2022-39349
The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity ShareLinkActivity.kt to handle "share" intents coming from other components in the same device and convert them to tasks. Those intents may contain arbitrary file paths as attachment...
CVE-2022-27623
Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors...
PT-2022-18529 · Synology · Synology Diskstation Manager
Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 7.1-42661 Description: The issue concerns a missing authentication mechanism for a critical function in the iSCSI management functionality. This allows remote attackers to read or write...
Synology DiskStation Manager 访问控制错误漏洞
Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology, a Chinese company. The operating system manages data, files, photos, music and other information. A security vulnerability exists in Synology DiskStation Manager DSM versions prior to...
PT-2022-24888 · Unknown · Gin-Vue-Admin
Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: The issue concerns an arbitrary file read due to insufficient validation of the fileMd5 and fileName parameters in the file upload functionality. This allows unauthorized access to files. The...
Denial Of Service (DoS)
darkhttpd is vulnerable to denial of service. The vulnerability exists when accessing a file with a large modification date which allows an attacker to cause an application crash...
VulnCheck KEV: CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and oth...
Welcart eCommerce < 2.7.8 - Unauthenticated Arbitrary File Access
The plugin does not validate user input used in a path, which could allow unauthenticated users to read arbitrary files via a traversal attack...
Cisco Identity Services Engine Unauthorized File Access Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to list, download, and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could explo...
CVE-2022-43414: Files or Directories Accessible to External Parties
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified directory on the Jenkins controller...
PT-2022-26913 · Compuware +1 · Jenkins Compuware Topaz For Total Test Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Topaz for Total Test Plugin versions 2.4.8 and earlier Description: The issue allows attackers who can control agent processes to read arbitrary files on the Jenkins controller file system due to an agent/controller message...
CVE-2022-39058 Changing Information Technology Inc. RAVA certificate validation system - Path Traversal
RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access arbitrary system files...
CVE-2022-22241
An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the...
Input validation
An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the...
CVE-2022-22241: Improper Input Validation
An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the...