CVE-2022-36642

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

Design/Logic Flaw

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

PT-2022-23526 · Telos Alliance · Telos Alliance Omnia Mpx Node

Name of the Vulnerable Software and Affected Versions: Telos Alliance Omnia MPX Node versions 1.0.0 through 1.5.0+r1 Description: A local file disclosure issue in the /appConfig/userDB.json file allows attackers to access user credentials, potentially gaining initial access to the control panel...

PT-2022-20588 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 3.6.1 Description: An unauthorized file disclosure issue was identified in Grafana, allowing a malicious user to retrieve unauthorized files under certain network conditions or via a fake datasource, particularly if...

Telos Alliance Omnia MPX Node 安全漏洞

The Telos Alliance Omnia MPX Node is a specialized hardware codec from Telos Alliance, USA. Capable of sending or receiving full FM signals at data rates as low as 320 kbps using the Omnia μMPXTM algorithm, it is ideally suited for capacity-limited networks including IP radios. A security...

CVE-2022-31176 Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-31176 Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

CVE-2022-31176

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

FreeBSD : Grafana -- Unauthorized file disclosure (827b95ff-290e-11ed-a2e7-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 827b95ff-290e-11ed-a2e7-6c3be5272acd advisory. - Grafana Labs reports: On July 21, an internal security review identified an unauthorized file...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0 (Firmware A2.1.0–B2.1.0; Software v16 13020200; App 2.15.4A) is affected by an unauthenticated arbitrary file disclosure due to improper verification of the 'file' GET parameter in logdownload.cgi. The vulnerability allows directory traversal to disclose arb...

EUVD-2022-39775

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

Carel pCOWeb HVAC BACnet Gateway 路径遍历漏洞

Carel pCOWeb is a programmable control card. A security vulnerability exists in Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware versions A2.1.0 - B2.1.0, Application Software version 2.15.4A, and Software v16 13020200, which stems from the presence of an unauthenticated Arbitrary File Disclosure...

Grafana Image Renderer leaking files

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome. An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized fil...

Hardcoded credentials

Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg...

WordPress plugin WPIDE 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2021-26639

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...