15905 matches found
CVE-2021-45097: Insufficiently Protected Credentials
KNIME Server before 4.12.6 and 4.13.x before 4.13.4 when installed in unattended mode keeps the administrator's password in a file without appropriate file access controls, allowing all local users to read its content...
CVE-2021-43831
Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access an...
CVE-2021-43836
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18...
CVE-2021-43831
Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access an...
CVE-2021-43831
CVE-2021-43831 affects Gradio (
CVE-2021-43831 Files on the host computer can be accessed from the Gradio interface
Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access an...
Design/Logic Flaw
In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product:...
Information Disclosure
opencast-common is vulnerable to Information Disclosure. The attack is possible because the library does not restrict the file access and authenticate against external services listed in a media package, leading to disclose the global system user's credentials to the outside cluster...
CVE-2021-43821
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interfac...
CVE-2021-43821 Files Accessible to External Parties in Opencast
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interfac...
CVE-2021-39312
The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...
CVE-2021-39312
The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...
Code injection
The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...
CVE-2021-39312
Summary: CVE-2021-39312 affects the WordPress True Ranker plugin prior to 2.2.4. The vulnerability is an improper filtering flaw in the local file inclusion path in ~/admin/vendor/datatables/examples/resources/examples.php, allowing an attacker to read arbitrary files (e.g., wp-config.php) via th...
CVE-2021-42022
A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package All versions V21.00 SP3. When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the...
PT-2021-23960 · Patrowl · Patrowl
Name of the Vulnerable Software and Affected Versions: PatrOwl versions prior to 1.77 Description: The issue is related to improper privilege management in PatrowlManager, allowing unlogged-in users to download all finding import files. The files are stored under /media/imports//, where owner id ...
CVE-2021-43821: Files or Directories Accessible to External Parties
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interfac...
PT-2021-6321 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an elevation-of-privilege vulnerability in Windows Setup. It is caused by incorrect link resolution before accessing a file, which can allow an attacker to elevate...
True Ranker < 2.2.4 - Unauthenticated Arbitrary File Access via Path Traversal
The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file. PoC Exploit Authors: Nicole Sheinin, Liad Levy Tested on: MacOS !/usr/bin/env python3...
CVE-2021-39312: Improper Limitation of a Pathname to a Restricted Directory
The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...