15692 matches found
RustEmbed generated `get` method allows for directory traversal when reading files from disk
When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...
Spoofing
CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any file on the system...
Design/Logic Flaw
Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Mint WorkBench installer file allows a low-privileged user to run a "repair" operation o...
CVE-2022-20146
In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...
CVE-2022-20146
In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...
Design/Logic Flaw
In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...
CVE-2022-20146
In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...
CVE-2022-20146
CVE-2022-20146 affects Android via the information disclosure in the uploadFile function of FileUploadServiceImpl.java, caused by a confused deputy that can expose private files locally without extra privileges. Exploitation is local and does not require user interaction. Public details in the co...
CVE-2022-20736: Improper Authorization in Handler for Custom URL Scheme
A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console that they would not normally have authorization to access. This...
CVE-2022-29238 Forced Browsing in Jupyter Notebook
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with ContentsManager.allowhidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files...
CVE-2022-29509
Directory traversal vulnerability in T&D Data Server Japanese Edition Ver.2.22 and earlier, T&D Data Server English Edition Ver.2.30 and earlier, THERMO RECORDER DATA SERVER Japanese Edition Ver.2.13 and earlier, and THERMO RECORDER DATA SERVER English Edition Ver.2.13 and earlier allows a remote...
CVE-2022-29509
CVE-2022-29509 is a directory traversal vulnerability in T&D Data Server (Japanese Edition v2.22 and earlier) and (English Edition) v2.30 and earlier, and THERMO RECORDER DATA SERVER (Japanese/English) v2.13 and earlier. The root cause is an input validation issue that allows a remote attacker to...
PT-2022-21179 · Siemens · Sinema Remote Connect Server
Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified due to improper input validation, which could allow the OpenSSL certificate's password to be printed to a file reachable by an attacker...
Jupyter Notebook 安全漏洞
Jupyter Notebook is a suite of open source web applications for creating and sharing code and illustrative text documents. A security vulnerability exists in Jupyter Notebook versions prior to 6.4.12, which stems from the fact that any authenticated request can access files...
Siemens SCALANCE LPE9403 Third-Party Vulnerabilities
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely, low attack complexity Vendor: Siemens Equipment: SCALANCE LPE9403 Vulnerabilities: Multiple 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause crashes and unrestricted file access, impacting the...
CVE-2022-23167
CVE-2022-23167 affects Amodat Mobile Application Gateway. The issue is a Local File Inclusion (LFI) in the web endpoint implemented as /mobile/downloadfile.aspx?Filename=../.. /windows/boot.ini, reachable unauthenticated. This allows an attacker to read sensitive files on the host. Public materia...
CVE-2022-26041: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors...
CVE-2021-40668
The Android application HTTP File Server Version 1.4.1 by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write...
Vite directory traversal vulnerability
Vite is a new front-end builder that significantly improves the front-end development experience, and is vulnerable to directory traversal, which could be exploited to access local file systems...